feat: add pam-pkcs11 configuration

Recommends sssd, sssd-tools, libpam-sss
Add SSSD configuration (sssd.conf)
Configure certificates for SSSD (postinst)
Restart SSSD service (postinst)

debian/control

@@ -14,14 +14,16 @@ Multi-Arch: foreign
 Breaks: orange-yourdev-kerberos
 Replaces: orange-yourdev-kerberos
 Depends: ${misc:Depends},
-  libpam-krb5,
+  sssd (>= 2.4.0),
+  libpam-sss,
+  libpam-pkcs11,
   libpam-ccreds,
   orange-certs, 
   orange-krb5, 
   orange-dongle-aladdin
 Recommends: 
   krb5-auth-dialog,
-  libpam-pkcs11
+  sssd-tools
 Suggests:
   orange-yourdev-ldap, 
   orange-yourdev-setup, 

debian/postinst

@@ -8,9 +8,15 @@ case "$1" in
             dconf update
         fi
 
-        # Configure NSS for pam-pkcs11
+        # Configure NSS for pam-pkcs11 and pam-sss
 	mkdir -p /etc/pki/nssdb
-	orange-certupdate /etc/pki/nssdb || true
+	orange-certupdate /etc/pki/nssdb >/dev/null || true
+        orange-dongle-aladdin --force update /etc/pki/nssdb || true
+
+        # Configure certificates for SSSD (OpenSSL)
+        mkdir -p /etc/sssd/pki
+        cat /usr/share/ca-certificates/orange/*.crt \
+            > /etc/sssd/pki/sssd_auth_ca_db.pem
 
         # configure pam-pkcs11
         if [ -d /etc/pam_pkcs11 ] ; then
@@ -33,9 +39,22 @@ case "$1" in
         fi
 
         # Configure PAM for Kerberos
-        if [ -e /usr/share/pam-configs/krb5 ] ; then
+        if [ -e /usr/share/pam-configs/sss ] ; then
+            # Use pam-sss if present and disable pam-krb5
+            echo "Using pam-sss ..."
+            pam-auth-update --force --package --enable sss || true
+            pam-auth-update --force --package --remove krb5 || true
+        elif [ -e /usr/share/pam-configs/krb5 ] ; then
+            echo "Using pam-krb5 ..."
             pam-auth-update --force --package --enable krb5 || true
+        else
+            echo "Warning: no PAM config for Kerberos found!"
         fi
+
+        # fix sssd configuration permissions
+        chmod 600 /etc/sssd/sssd.conf || true
+        # restart services
+        deb-systemd-invoke restart sssd.service || true
     ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)