[pam]
pam_cert_auth = true
pam_cert_db_path = /etc/sssd/pki/sssd_auth_ca_db.pem
p11_child_timeout = 60
offline_credentials_expiration = 0

[domain/ad.francetelecom.fr]
local_auth_policy = enable:smartcard
access_provider = permit
krb5_validate = false
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U

[certmap/ad.francetelecom.fr]
matchrule = <ISSUER>.*Orange Internal G2 User Class 2 CA.*
maprule = (uid:{subject_uid})
domains = ad.francetelecom.fr