URL:
https://github.com/SSSD/sssd/pull/268
Title: #268: pam_sss: add support for SSS_PAM_CERT_INFO_WITH_HINT
sumit-bose commented:
"""
Still, why you cannot make that decision without an option's
help? Sorry, I don't see a difference -- why by seeing a certificate pam_sss cannot
defer decision to decide whether to accept missing name or not to a backend (SSSD) and
then act correspondingly?
Because in general I would expect that something is wrong when there is no user name.
Typically (currently the only exception is gdm with enabled Smartcard mode) application
request the user name on their own and then use it as an argument to pam_start(). Since
this is about authentication I'd prefer to error out early instead of sending
potentially bogus data to SSSD.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/268#issuecomment-300733240