# Smartcard auth is handled by pam_exec + kinit (PKINIT) directly,
# bypassing SSSD certmap (which proved unreliable with SafeNet
# tokens having multiple certs). See gdm-smartcard-pkinit PAM service.
# SSSD is only used for password auth and NSS user lookups.

[pam]
pam_cert_auth = false
pam_cert_db_path = /etc/sssd/pki/sssd_auth_ca_db.pem
p11_child_timeout = 60
offline_credentials_expiration = 0

[domain/ad.francetelecom.fr]
local_auth_policy = enable:smartcard
access_provider = permit
krb5_validate = false
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U