8686a76b06
Debian package for PKI-based session authentication with Orange AD. - Direct PKINIT auth via pam_exec + kinit (bypasses SSSD certmap) - GDM smartcard login with SafeNet eToken / Thales - Automatic Kerberos TGT via PKINIT - Compatible with orange-yourdev-login package
61 lines
1.9 KiB
Bash
Executable File
61 lines
1.9 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
|
|
case "$1" in
|
|
configure)
|
|
# Remove any certmap we previously added to sssd.conf
|
|
if [ -f /etc/sssd/sssd.conf ]; then
|
|
sed -i '/### certmap tmzf5455 yourdev-session-pki/d' /etc/sssd/sssd.conf 2>/dev/null || true
|
|
sed -i '/^\[certmap\/ad\.francetelecom\.fr\/tmzf5455\]/,/^$/d' /etc/sssd/sssd.conf 2>/dev/null || true
|
|
sed -i '/^\[certmap\/ad\.francetelecom\.fr\]/,/^$/d' /etc/sssd/sssd.conf 2>/dev/null || true
|
|
fi
|
|
|
|
# Disable our old pam-auth-update profile (try_cert_auth approach)
|
|
if command -v pam-auth-update >/dev/null 2>&1; then
|
|
pam-auth-update --package --remove yourdev-smartcard 2>/dev/null || true
|
|
fi
|
|
|
|
# Register our new GDM smartcard PAM service as the GDM alternative
|
|
if [ -f /etc/pam.d/gdm-smartcard-pkinit ]; then
|
|
update-alternatives --install /etc/pam.d/gdm-smartcard gdm-smartcard \
|
|
/etc/pam.d/gdm-smartcard-pkinit 60 2>/dev/null || true
|
|
update-alternatives --set gdm-smartcard /etc/pam.d/gdm-smartcard-pkinit 2>/dev/null || true
|
|
fi
|
|
|
|
# Ensure SSSD CA bundle permissions
|
|
if [ -f /etc/sssd/pki/sssd_auth_ca_db.pem ]; then
|
|
chown root:sssd /etc/sssd/pki/sssd_auth_ca_db.pem 2>/dev/null || true
|
|
fi
|
|
|
|
# Ensure conf.d permissions
|
|
for f in /etc/sssd/conf.d/*.conf; do
|
|
[ -f "$f" ] && chown root:sssd "$f" 2>/dev/null && chmod 0640 "$f" 2>/dev/null || true
|
|
done
|
|
|
|
if [ -f /etc/sssd/sssd.conf ]; then
|
|
chown root:sssd /etc/sssd/sssd.conf 2>/dev/null || true
|
|
chmod 0600 /etc/sssd/sssd.conf 2>/dev/null || true
|
|
fi
|
|
|
|
# Compile dconf database for GDM smartcard setting
|
|
if command -v dconf >/dev/null 2>&1; then
|
|
dconf update 2>/dev/null || true
|
|
fi
|
|
|
|
# Restart SSSD
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
systemctl restart sssd 2>/dev/null || true
|
|
fi
|
|
;;
|
|
|
|
abort-upgrade|abort-remove|abort-deconfigure)
|
|
;;
|
|
|
|
*)
|
|
echo "postinst called with unknown argument '$1'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
exit 0
|