#%PAM-1.0
# GDM smartcard PAM service using direct PKINIT via pam_exec + kinit
# Bypasses SSSD certmap. Falls back to common-auth (password) if
# no smartcard or PKINIT fails.
auth    [success=done default=ignore] pam_exec.so expose_authtok /usr/lib/yourdev-session-pki/pkinit-auth.sh
auth    substack        common-auth
auth    requisite       pam_nologin.so
auth    optional        pam_gnome_keyring.so

@include common-account

session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
session required        pam_loginuid.so
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
session optional        pam_keyinit.so force revoke
session required        pam_limits.so
session required        pam_env.so readenv=1
session required        pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale
@include common-session
session optional        pam_gnome_keyring.so auto_start
@include common-password