Hi,
that attached two patches would allow to use the Smartcard support in
gdm with SSSD. To use it you should replace pam_pkcs11 in
/etc/pam.d/smartcard-auth in the auth section by
auth sufficient pam_sss.so allow_missing_name
and drop the password section completely.
To enable the Smartcard support in gdm the easiest way is to use
dconf-editor:
DCONF_PROFILE=gdm dconf-editor
In the org/gnome/login-screen section you can switch the Smartcard
support on and off. Additionally you might want to tune the removal
action in org/gnome/settings-daemon/peripherals/smartcard .
If now a Smartcard is inserted gdm should register it, call
/etc/pam.d/gdm-smartcard which calls /etc/pam.d/smartcard-auth without a
user name. With the new option from the first patch pam_sss will accept
this and send it to the pam responder. The pam responder can handle this
if Smartcard authentication is enabled, tries to read the certificate
from the Smartcard, tries to find and matching user and if successful,
returns the user name to pam_sss which puts it on the PAM stack and
continues with the authentication.
It would be nice if someone can review the code even without testing the
functionality. In this case I will ask someone else with access to
Smartcards and reader to do some functional testing.
I think these patches are candidates for the pam wrapper based tests
Jakub has for review on the list. I'll start reviewing those and add
tests when they are in master.
bye,
Sumit