Initial commit: yourdev-session-pki package

Debian package for PKI-based session authentication with Orange AD.
- Direct PKINIT auth via pam_exec + kinit (bypasses SSSD certmap)
- GDM smartcard login with SafeNet eToken / Thales
- Automatic Kerberos TGT via PKINIT
- Compatible with orange-yourdev-login package

debian-pkg/yourdev-session-pki_1.0_all/etc/sssd/conf.d/yourdev-smartcard.conf

@@ -0,0 +1,17 @@
+# Smartcard auth is handled by pam_exec + kinit (PKINIT) directly,
+# bypassing SSSD certmap (which proved unreliable with SafeNet
+# tokens having multiple certs). See gdm-smartcard-pkinit PAM service.
+# SSSD is only used for password auth and NSS user lookups.
+
+[pam]
+pam_cert_auth = false
+pam_cert_db_path = /etc/sssd/pki/sssd_auth_ca_db.pem
+p11_child_timeout = 60
+offline_credentials_expiration = 0
+
+[domain/ad.francetelecom.fr]
+local_auth_policy = enable:smartcard
+access_provider = permit
+krb5_validate = false
+krb5_ccachedir = /tmp
+krb5_ccname_template = FILE:%d/krb5cc_%U