#1052392 libpam-sss: Please ship a PAM config file for pam_sss_gss.so

Package:
libpam-sss
Source:
libpam-sss
Description:
Pam module for the System Security Services Daemon
Submitter:
Sam Morris
Date:
2023-09-21 10:03:03 UTC
Severity:
normal
#1052392#5
Date:
2023-09-21 09:24:43 UTC
From:
To:
Here's the config file I am using:

    $ cat /usr/share/pam-configs/sss-gss
    Name: Authenticate if the user can obtain a valid Kerberos ticket for the local host
    Default: yes
    Priority: 512

    Auth-Type: Primary
    Auth:
	    [success=end default=ignore]	pam_sss_gss.so
    Auth-Initial:
	    [success=end default=ignore]	pam_sss_gss.so

However it can't be added to the package yet because it will break
authentication for non-local users (beacuse we use the 'use_first_pass'
option with pam_sss.so when it's not the initial module, so a non-local
user is not able to log in when pam_sss.so is not the initial module and
no prior modules stashed a password for it to consume).

For the time being we need 'use_first_pass' so that non-local users
don't get prompted by _both_ pam.unix.so and pam_sss.so.

Ideally pam_sss.so would have a 'try_first_pass' option which would
unblock us from shipping an sss-gss pam config. I've filed an RFE here:
<https://github.com/SSSD/sssd/issues/6946>.