feat: add pam-pkcs11 configuration

Recommends libpam-pkcs11 package.
Add configuration for Safenet module (pam_pkcs11.conf)
Add UID mapper generator (pkcs11_generate_uids)
Configure certificates for pam_pkcs11 from postinst.

debian/control

@@ -20,7 +20,8 @@ Depends: ${misc:Depends},
   orange-krb5, 
   orange-dongle-aladdin
 Recommends: 
-  krb5-auth-dialog
+  krb5-auth-dialog,
+  libpam-pkcs11
 Suggests:
   orange-yourdev-ldap, 
   orange-yourdev-setup, 

debian/postinst

@@ -7,12 +7,31 @@ case "$1" in
         if [ -x /usr/bin/dconf ] ; then
             dconf update
         fi
+
+        # Configure NSS for pam-pkcs11
+	mkdir -p /etc/pki/nssdb
+	orange-certupdate /etc/pki/nssdb || true
+
+        # configure pam-pkcs11
+        if [ -d /etc/pam_pkcs11 ] ; then
+            # add Orange certificates
+            mkdir -p /etc/pam_pkcs11/cacerts
+            cp /usr/share/ca-certificates/orange/* /etc/pam_pkcs11/cacerts
+            (cd /etc/pam_pkcs11/cacerts && pkcs11_make_hash_link ) || true
+            # generate uid mapping from /etc/passwd
+            pkcs11_generate_uids || true
+            # Note: PAM module pkcs11 cannot be configured using command
+            # pam-auth-update because package libpam-pkcs11 does not provide 
+            # a config file in dir /usr/share/pam-configs.
+        fi
+
         # Configure PAM for credential cache 
         apt-mark manual libpam-ccreds >/dev/null || true
         if [ -e /usr/share/pam-configs/ccreds-check ] ; then
             pam-auth-update --force --package --enable \
                 ccreds-check ccreds-save || true
         fi
+
         # Configure PAM for Kerberos
         if [ -e /usr/share/pam-configs/krb5 ] ; then
             pam-auth-update --force --package --enable krb5 || true