8686a76b06
Debian package for PKI-based session authentication with Orange AD. - Direct PKINIT auth via pam_exec + kinit (bypasses SSSD certmap) - GDM smartcard login with SafeNet eToken / Thales - Automatic Kerberos TGT via PKINIT - Compatible with orange-yourdev-login package
18 lines
578 B
Plaintext
18 lines
578 B
Plaintext
# Smartcard auth is handled by pam_exec + kinit (PKINIT) directly,
|
|
# bypassing SSSD certmap (which proved unreliable with SafeNet
|
|
# tokens having multiple certs). See gdm-smartcard-pkinit PAM service.
|
|
# SSSD is only used for password auth and NSS user lookups.
|
|
|
|
[pam]
|
|
pam_cert_auth = false
|
|
pam_cert_db_path = /etc/sssd/pki/sssd_auth_ca_db.pem
|
|
p11_child_timeout = 60
|
|
offline_credentials_expiration = 0
|
|
|
|
[domain/ad.francetelecom.fr]
|
|
local_auth_policy = enable:smartcard
|
|
access_provider = permit
|
|
krb5_validate = false
|
|
krb5_ccachedir = /tmp
|
|
krb5_ccname_template = FILE:%d/krb5cc_%U
|