Initial commit: yourdev-session-pki package

Debian package for PKI-based session authentication with Orange AD.
- Direct PKINIT auth via pam_exec + kinit (bypasses SSSD certmap)
- GDM smartcard login with SafeNet eToken / Thales
- Automatic Kerberos TGT via PKINIT
- Compatible with orange-yourdev-login package

debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/conffiles

@@ -0,0 +1,5 @@
+/etc/krb5.conf
+/etc/pam.d/gdm-smartcard-pkinit
+/etc/sssd/pki/sssd_auth_ca_db.pem
+/etc/sssd/conf.d/yourdev-smartcard.conf
+/etc/dconf/db/gdm.d/02-smartcard-enable

debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/control

@@ -0,0 +1,15 @@
+Package: yourdev-session-pki
+Version: 1.0.0
+Architecture: all
+Maintainer: Tallagrand Thierry <thierry.tallagrand@orange.com>
+Installed-Size: 128
+Depends: sssd, sssd-krb5, krb5-user, libpam-sss, opensc, p11-kit, openssl, ca-certificates, dconf-cli, libpam-modules
+Recommends: gdm3, gnome-keyring, pinentry-gnome3
+Section: admin
+Priority: optional
+Homepage: https://ad.francetelecom.fr
+Description: YourDev PKI-based session authentication for Orange AD
+ Configure SSSD, Kerberos (PKINIT), and PAM for smartcard
+ (Safenet eToken / Thales) and password-based login with
+ automatic Kerberos ticket (TGT) generation via AD.FRANCETELECOM.FR.
+ Supports GDM, SSH, and console login with both methods.

debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/postinst

@@ -0,0 +1,60 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+  configure)
+    # Remove any certmap we previously added to sssd.conf
+    if [ -f /etc/sssd/sssd.conf ]; then
+      sed -i '/### certmap tmzf5455 yourdev-session-pki/d' /etc/sssd/sssd.conf 2>/dev/null || true
+      sed -i '/^\[certmap\/ad\.francetelecom\.fr\/tmzf5455\]/,/^$/d' /etc/sssd/sssd.conf 2>/dev/null || true
+      sed -i '/^\[certmap\/ad\.francetelecom\.fr\]/,/^$/d' /etc/sssd/sssd.conf 2>/dev/null || true
+    fi
+
+    # Disable our old pam-auth-update profile (try_cert_auth approach)
+    if command -v pam-auth-update >/dev/null 2>&1; then
+      pam-auth-update --package --remove yourdev-smartcard 2>/dev/null || true
+    fi
+
+    # Register our new GDM smartcard PAM service as the GDM alternative
+    if [ -f /etc/pam.d/gdm-smartcard-pkinit ]; then
+      update-alternatives --install /etc/pam.d/gdm-smartcard gdm-smartcard \
+        /etc/pam.d/gdm-smartcard-pkinit 60 2>/dev/null || true
+      update-alternatives --set gdm-smartcard /etc/pam.d/gdm-smartcard-pkinit 2>/dev/null || true
+    fi
+
+    # Ensure SSSD CA bundle permissions
+    if [ -f /etc/sssd/pki/sssd_auth_ca_db.pem ]; then
+      chown root:sssd /etc/sssd/pki/sssd_auth_ca_db.pem 2>/dev/null || true
+    fi
+
+    # Ensure conf.d permissions
+    for f in /etc/sssd/conf.d/*.conf; do
+      [ -f "$f" ] && chown root:sssd "$f" 2>/dev/null && chmod 0640 "$f" 2>/dev/null || true
+    done
+
+    if [ -f /etc/sssd/sssd.conf ]; then
+      chown root:sssd /etc/sssd/sssd.conf 2>/dev/null || true
+      chmod 0600 /etc/sssd/sssd.conf 2>/dev/null || true
+    fi
+
+    # Compile dconf database for GDM smartcard setting
+    if command -v dconf >/dev/null 2>&1; then
+      dconf update 2>/dev/null || true
+    fi
+
+    # Restart SSSD
+    if command -v systemctl >/dev/null 2>&1; then
+      systemctl restart sssd 2>/dev/null || true
+    fi
+    ;;
+
+  abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+  *)
+    echo "postinst called with unknown argument '$1'" >&2
+    exit 1
+    ;;
+esac
+
+exit 0

debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/prerm

@@ -0,0 +1,36 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+  remove|purge)
+    # Remove our GDM smartcard PAM alternative
+    if [ -f /etc/pam.d/gdm-smartcard-pkinit ]; then
+      update-alternatives --remove gdm-smartcard /etc/pam.d/gdm-smartcard-pkinit 2>/dev/null || true
+    fi
+
+    # Remove our old pam-auth-update profile if lingering
+    if command -v pam-auth-update >/dev/null 2>&1; then
+      pam-auth-update --package --remove yourdev-smartcard 2>/dev/null || true
+    fi
+
+    # Recompile dconf after removing our override
+    if command -v dconf >/dev/null 2>&1; then
+      dconf update 2>/dev/null || true
+    fi
+
+    # Restart SSSD
+    if command -v systemctl >/dev/null 2>&1; then
+      systemctl restart sssd 2>/dev/null || true
+    fi
+    ;;
+
+  upgrade|failed-upgrade)
+    ;;
+
+  *)
+    echo "prerm called with unknown argument '$1'" >&2
+    exit 1
+    ;;
+esac
+
+exit 0