Initial commit: yourdev-session-pki package

Debian package for PKI-based session authentication with Orange AD.
- Direct PKINIT auth via pam_exec + kinit (bypasses SSSD certmap)
- GDM smartcard login with SafeNet eToken / Thales
- Automatic Kerberos TGT via PKINIT
- Compatible with orange-yourdev-login package

debian-pkg/yourdev-session-pki_1.0_all/etc/pam.d/gdm-smartcard-pkinit

@@ -0,0 +1,21 @@
+#%PAM-1.0
+# GDM smartcard PAM service using direct PKINIT via pam_exec + kinit
+# Bypasses SSSD certmap. Falls back to common-auth (password) if
+# no smartcard or PKINIT fails.
+auth    [success=done default=ignore] pam_exec.so expose_authtok /usr/lib/yourdev-session-pki/pkinit-auth.sh
+auth    substack        common-auth
+auth    requisite       pam_nologin.so
+auth    optional        pam_gnome_keyring.so
+
+@include common-account
+
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
+session required        pam_loginuid.so
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
+session optional        pam_keyinit.so force revoke
+session required        pam_limits.so
+session required        pam_env.so readenv=1
+session required        pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale
+@include common-session
+session optional        pam_gnome_keyring.so auto_start
+@include common-password