#!/bin/sh
# SPDX-License-Identifier: Orange-InnerSource

set -e

case "$1" in
    configure)
        # Enable GDM customization
        if command -v /usr/bin/dconf >/dev/null ; then
            dconf update
        fi

        # Configure NSS for pam-pkcs11 and pam-sss
	mkdir -p /etc/pki/nssdb
	orange-certupdate /etc/pki/nssdb >/dev/null || true
        orange-dongle-aladdin --force update /etc/pki/nssdb || true

        # Configure certificates for SSSD (OpenSSL)
        mkdir -p /etc/sssd/pki
        cat /usr/share/ca-certificates/orange/*.crt \
            > /etc/sssd/pki/sssd_auth_ca_db.pem

        # Configure pam-pkcs11
        if [ -d /etc/pam_pkcs11 ] ; then
            # add Orange certificates
            mkdir -p /etc/pam_pkcs11/cacerts
            cp /usr/share/ca-certificates/orange/* /etc/pam_pkcs11/cacerts
            (cd /etc/pam_pkcs11/cacerts && pkcs11_make_hash_link ) || true
            # generate uid mapping from /etc/passwd
            pkcs11_generate_uids || true
            # Note: PAM module pkcs11 cannot be configured using command
            # pam-auth-update because package libpam-pkcs11 does not provide 
            # a config file in dir /usr/share/pam-configs.
        fi

	# Configure PAM
	pam-auth-update --package \
	    --remove sss krb5 \
	    --enable yourdev ccreds-check ccreds-save || true
	for profile in sss krb5 yourdev ; do
            grep -qw "$profile" /var/lib/pam/seen \
            || echo "$profile" >> /var/lib/pam/seen || true
        done

        # Fix sssd configuration permissions
        chmod 600 /etc/sssd/sssd.conf || true
        # Restart services
        deb-systemd-invoke restart sssd.service || true
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts.

#DEBHELPER#

exit 0