feat: add pam-pkcs11 configuration

Recommends sssd, sssd-tools, libpam-sss
Add SSSD configuration (sssd.conf)
Configure certificates for SSSD (postinst)
Restart SSSD service (postinst)

etc/sssd/sssd.conf

@@ -0,0 +1,40 @@
+# SSSD configuration for Kerberos in Orange network
+# 
+[sssd]
+config_file_version = 2
+domains = ad.francetelecom.fr
+certificate_verification = no_ocsp
+services = nss
+debug_level = 9
+
+[nss]
+filter_users = root
+filter_groups = root
+debug_level = 9
+
+[pam]
+pam_verbosity = 3
+pam_account_expired_message = Account expired, please contact help desk.
+pam_account_locked_message = Account locked, please contact help desk
+pam_public_domains = ad.francetelecom.fr
+pam_cert_auth = false
+p11_child_timeout = 60
+offline_credentials_expiration = 0
+debug_level = 9
+
+[domain/ad.francetelecom.fr]
+min_id = 1000
+id_provider = files
+auth_provider = krb5
+cache_credentials = true
+use_fully_qualified_names = false
+krb5_realm = AD.FRANCETELECOM.FR
+krb5_auth_timeout = 10
+krb5_store_password_if_offline = true
+krb5_lifetime = 24h
+krb5_renewable_lifetime = 7d
+krb5_renew_interval = 30m
+# see /etc/krb5.conf
+krb5_use_kdcinfo = false
+debug_level = 9
+