Initial commit: yourdev-session-pki package

Debian package for PKI-based session authentication with Orange AD.
- Direct PKINIT auth via pam_exec + kinit (bypasses SSSD certmap)
- GDM smartcard login with SafeNet eToken / Thales
- Automatic Kerberos TGT via PKINIT
- Compatible with orange-yourdev-login package

debian-pkg/yourdev-session-pki_1.0_all/etc/krb5.conf

@@ -0,0 +1,50 @@
+[libdefaults]
+	default_realm = AD.FRANCETELECOM.FR
+
+	kdc_timesync = 1
+	ccache_type = 4
+	default_ccache_name = FILE:/tmp/krb5cc_%{uid}
+
+	forwardable = true
+	proxiable = true
+	rdns = false
+	ignore_acceptor_hostname = true
+
+	dns_lookup_kdc = false
+	dns_lookup_realm = false
+
+	udp_preference_limit = 1
+
+	fcc-mit-ticketflags = true
+
+[realms]
+	AD.FRANCETELECOM.FR = {
+		kdc = opadya31.bagnolet.francetelecom.fr
+		kdc = sfebuo31.intranet-paris.francetelecom.fr
+		kdc = opadyx51.rouen.francetelecom.fr
+		kdc = sfebua31.bagnolet.francetelecom.fr
+		kdc = opadyx81.rouen.francetelecom.fr
+
+		kpasswd_server = opadya31.bagnolet.francetelecom.fr
+		kpasswd_server = sfebuo31.intranet-paris.francetelecom.fr
+		kpasswd_server = opadyx51.rouen.francetelecom.fr
+		kpasswd_server = sfebua31.bagnolet.francetelecom.fr
+		kpasswd_server = opadyx81.rouen.francetelecom.fr
+
+		pkinit_anchors = DIR:/usr/share/ca-certificates/orange
+
+		pkinit_identities = PKCS11:/usr/lib/libeToken.so:certid=61757468
+
+		pkinit_eku_checking = none
+
+		pkinit_kdc_hostname = opadya31.bagnolet.francetelecom.fr
+		pkinit_kdc_hostname = sfebuo31.intranet-paris.francetelecom.fr
+		pkinit_kdc_hostname = opadyx51.rouen.francetelecom.fr
+		pkinit_kdc_hostname = sfebua31.bagnolet.francetelecom.fr
+		pkinit_kdc_hostname = opadyx81.rouen.francetelecom.fr
+		pkinit_kdc_hostname = vipadyappli.itn.intraorange
+	}
+
+[domain_realm]
+	.ad.francetelecom.fr = AD.FRANCETELECOM.FR
+	ad.francetelecom.fr = AD.FRANCETELECOM.FR