Add pam_cert_pam_services option

[abbra]

Allow customizing which PAM services are allowed to perform smartcard
authentication.

Fixes: https://pagure.io/SSSD/sssd/issue/3775

[centos-ci]

Can one of the admins verify this patch?

[centos-ci]

Can one of the admins verify this patch?

[fidencio]

ok to test

[fidencio]

@abbra, patch looks good to me.
I'd also provide a scratch-build to Orion in order to be sure it works for him.

In any case, if it's not urgent I'd also like to have either @jhrozek's or @sumit-bose's eyes on this PR.

[sumit-bose]

Hi Alexander,

thank you for the patch. There is an old patch by @lslebodn which tries to solve the same issue at https://lists.fedoraproject.org/archives/list/sssd-devel@lists.fedorahosted.org/thread/FQWOBQV6FFCBKZS2EXKIJU74473E7R7Y/

I'd like to ask you if you can use the '+service' '-service' scheme as well because imo it would make the configuration easier to write and read and less error-prone.

bye,
Sumit

[sumit-bose]

@lslebodn created a PR with his old patch at https://pagure.io/SSSD/sssd/pull-request/3799.

@abbra, would you agree that the +- style makes the configuration easier or do you see advantages to always specify the full list?

[abbra]

I think +service style is better. Sorry for slow answers, I'm at the conference this week.

[abbra]

I'm also fine with @lslebodn patch

[fidencio]

@sumit-bose, shall we go for @lslebodn's patch instead?
If so, I'd close this PR and push https://pagure.io/SSSD/sssd/pull-request/3799 Tomorrow.

[sumit-bose]

@fidencio, yes, I'm currently reviewing @lslebodn patch.

[fidencio]

@lslebodn's patch has been merged, thus I'm closing this PR.