Add sssd supportpambase-20240119

Bug: https://bugs.gentoo.org/726050
Closes: https://github.com/gentoo/pambase/issues/1
Signed-off-by: Christopher Byrne <salah.coronya@gmail.com>
Closes: https://github.com/gentoo/pambase/pull/17
Signed-off-by: Sam James <sam@gentoo.org>

2 files changed, 36 insertions, 6 deletions

diff --git a/templates/system-auth.tpl b/templates/system-auth.tpl
index 9b078f3..4065e89 100644
--- a/templates/system-auth.tpl
+++ b/templates/system-auth.tpl
@@ -7,34 +7,55 @@ auth		sufficient	pam_ssh.so
 auth		[success={{ 4 if homed else 3 }} default=ignore]      pam_krb5.so {{ krb5_params }}
 {% endif %}
 
+{% if sssd %}
+auth		[default=1 ignore=ignore success=ok]	pam_usertype.so isregular
+auth		[default=3 ignore=ignore success=ok]	pam_localuser.so
+{% endif %}
+
 auth		requisite	pam_faillock.so preauth
+
 {% if homed %}
 auth            [success=2 default=ignore]      pam_systemd_home.so
 {% endif %}
+
+{% if sssd %}
+auth            sufficient    pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }}
+{% else %}
 auth            [success=1 new_authtok_reqd=1 ignore=ignore default=bad]      pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass
+{% endif %}
 auth		[default=die]	pam_faillock.so authfail
-
+{% if sssd %}
+auth		sufficient	pam_sss.so forward_pass {{ debug|default('', true) }}
+{% endif %}
 {% if caps %}
 auth		optional	pam_cap.so
 {% endif %}
-
+{% if sssd %}
+auth		sufficient	pam_deny.so
+{% endif %}
 {% if krb5 %}
 account		[success=2 default=ignore]	pam_krb5.so {{ krb5_params }}
 {% endif %}
 
 {% if homed %}
-account         [success=1 default=ignore]      pam_systemd_home.so
+account         [success={{ 2 if sssd else 1 }} default=ignore]      pam_systemd_home.so
 {% endif %}
 
 account		required	pam_unix.so {{ debug|default('', true) }}
 account         required        pam_faillock.so
+{% if sssd %}
+account		sufficient	pam_localuser.so
+account		sufficient	pam_usertype.so issystem
+account		[default=bad success=ok user_unknown=ignore] pam_sss.so {{ debug|default('', true) }}
+account		required	pam_permit.so
+{% endif %}
 
 {% if passwdqc %}
 password	required	pam_passwdqc.so config=/etc/security/passwdqc.conf
 {% endif %}
 
 {% if pwquality %}
-password        required        pam_pwquality.so
+password        required        pam_pwquality.so {{ local_users_only|default('', true ) }}
 {% endif %}
 
 {% if pwhistory %}
@@ -50,9 +71,14 @@ password        [success=1 default=ignore]      pam_systemd_home.so
 {% endif %}
 
 {% if passwdqc or pwquality %}
-password	required	pam_unix.so try_first_pass {{ unix_authtok|default('', true) }} {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
+password	{{ 'sufficient' if sssd else 'required' }}	pam_unix.so try_first_pass {{ unix_authtok|default('', true) }} {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
 {% else %}
-password        required        pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
+password        {{ 'sufficient' if sssd else 'required' }}        pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
+{% endif %}
+
+{% if sssd %}
+password	sufficient	pam_sss.so use_authtok
+password	required	pam_deny.so
 {% endif %}
 
 {% if pam_ssh %}
diff --git a/templates/system-session.tpl b/templates/system-session.tpl
index 536db49..4c5585b 100644
--- a/templates/system-session.tpl
+++ b/templates/system-session.tpl
@@ -13,3 +13,7 @@ session         [success=1 default=ignore]      pam_systemd_home.so
 {% endif %}
 
 session		required	pam_unix.so {{ debug|default('', true) }}
+
+{% if sssd %}
+session		optional	pam_sss.so {{ debug|default('', true) }}
+{% endif %}