feat: give higher priority to pam_sss module

With default priority (128), pam-auth-update put module pam_sss after
module pam_unix in /etc/pam.d/common-auth, and then a user with a
local account and local password synchronized with AD password will
never be granted a Kerberos TGT on session opening.

debian/postinst

@@ -3,7 +3,7 @@ set -e
 
 case "$1" in
     configure)
-        # enable GDM customization
+        # Enable GDM customization
         if command -v /usr/bin/dconf >/dev/null ; then
             dconf update
         fi
@@ -18,7 +18,7 @@ case "$1" in
         cat /usr/share/ca-certificates/orange/*.crt \
             > /etc/sssd/pki/sssd_auth_ca_db.pem
 
-        # configure pam-pkcs11
+        # Configure pam-pkcs11
         if [ -d /etc/pam_pkcs11 ] ; then
             # add Orange certificates
             mkdir -p /etc/pam_pkcs11/cacerts
@@ -31,28 +31,14 @@ case "$1" in
             # a config file in dir /usr/share/pam-configs.
         fi
 
-        # Configure PAM for credential cache 
-        apt-mark manual libpam-ccreds >/dev/null || true
-        if [ -e /usr/share/pam-configs/ccreds-check ] ; then
-            pam-auth-update --package --enable ccreds-check ccreds-save || true
-        fi
+	# Configure PAM
+	pam-auth-update --package \
+	    --remove sss krb5 \
+	    --enable yourdev ccreds-check ccreds-save || true
 
-        # Configure PAM for Kerberos
-        if [ -e /usr/share/pam-configs/sss ] ; then
-            # Use pam-sss if present and disable pam-krb5
-            echo "Using pam-sss ..."
-            pam-auth-update --package --enable sss || true
-            pam-auth-update --package --remove krb5 || true
-        elif [ -e /usr/share/pam-configs/krb5 ] ; then
-            echo "Using pam-krb5 ..."
-            pam-auth-update --package --enable krb5 || true
-        else
-            echo "Warning: no PAM config for Kerberos found!"
-        fi
-
-        # fix sssd configuration permissions
+        # Fix sssd configuration permissions
         chmod 600 /etc/sssd/sssd.conf || true
-        # restart services
+        # Restart services
         deb-systemd-invoke restart sssd.service || true
     ;;
 

debian/postrm

@@ -8,6 +8,7 @@ case "$1" in
             dconf update
         fi
     ;;
+
     remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
     ;;
 

debian/prerm

@@ -0,0 +1,24 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    remove)
+        pam-auth-update --package --remove yourdev || true
+    ;;
+
+    upgrade|deconfigure)
+    ;;
+
+    failed-upgrade)
+    ;;
+
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+
+#DEBHELPER#
+
+exit 0