#!/bin/sh
set -e

case "$1" in
    configure)
        # enable GDM customization
        if command -v /usr/bin/dconf >/dev/null ; then
            dconf update
        fi

        # Configure NSS for pam-pkcs11 and pam-sss
	mkdir -p /etc/pki/nssdb
	orange-certupdate /etc/pki/nssdb >/dev/null || true
        orange-dongle-aladdin --force update /etc/pki/nssdb || true

        # Configure certificates for SSSD (OpenSSL)
        mkdir -p /etc/sssd/pki
        cat /usr/share/ca-certificates/orange/*.crt \
            > /etc/sssd/pki/sssd_auth_ca_db.pem

        # configure pam-pkcs11
        if [ -d /etc/pam_pkcs11 ] ; then
            # add Orange certificates
            mkdir -p /etc/pam_pkcs11/cacerts
            cp /usr/share/ca-certificates/orange/* /etc/pam_pkcs11/cacerts
            (cd /etc/pam_pkcs11/cacerts && pkcs11_make_hash_link ) || true
            # generate uid mapping from /etc/passwd
            pkcs11_generate_uids || true
            # Note: PAM module pkcs11 cannot be configured using command
            # pam-auth-update because package libpam-pkcs11 does not provide 
            # a config file in dir /usr/share/pam-configs.
        fi

        # Configure PAM for credential cache 
        apt-mark manual libpam-ccreds >/dev/null || true
        if [ -e /usr/share/pam-configs/ccreds-check ] ; then
            pam-auth-update --force --package --enable \
                ccreds-check ccreds-save || true
        fi

        # Configure PAM for Kerberos
        if [ -e /usr/share/pam-configs/sss ] ; then
            # Use pam-sss if present and disable pam-krb5
            echo "Using pam-sss ..."
            pam-auth-update --force --package --enable sss || true
            pam-auth-update --force --package --remove krb5 || true
        elif [ -e /usr/share/pam-configs/krb5 ] ; then
            echo "Using pam-krb5 ..."
            pam-auth-update --force --package --enable krb5 || true
        else
            echo "Warning: no PAM config for Kerberos found!"
        fi

        # fix sssd configuration permissions
        chmod 600 /etc/sssd/sssd.conf || true
        # restart services
        deb-systemd-invoke restart sssd.service || true
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts.

#DEBHELPER#

exit 0