profiles/sssd/REQUIREMENTS - master - githubmirror/authselect

profiles/sssd/REQUIREMENTS
37 строк4 KB
Julian Rossbach
profiles: support oddjob-gpupdate in sssd
01 июн 2026, 12:52
01 июн 2026, 12:52b484633
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.
                                                                                          {include if "with-smartcard"}
- with-smartcard is selected, make sure smartcard authentication is enabled in sssd.conf: {include if "with-smartcard"}
  - set "pam_cert_auth = True" in [pam] section                                           {include if "with-smartcard"}
                                                                                          {include if "with-fingerprint"}
- with-fingerprint is selected, make sure fprintd service is configured and enabled       {include if "with-fingerprint"}
                                                                                          {include if "with-pam-gnome-keyring"}
- with-pam-gnome-keyring is selected, make sure the pam_gnome_keyring module              {include if "with-pam-gnome-keyring"}
  is present.                                                                             {include if "with-pam-gnome-keyring"}
                                                                                          {include if "with-pam-u2f"}
- with-pam-u2f is selected, make sure that the pam u2f module is installed                {include if "with-pam-u2f"}
  - users can then configure keys using the pamu2fcfg tool                                {include if "with-pam-u2f"}
                                                                                          {include if "with-pam-u2f-2fa"}
- with-pam-u2f-2fa is selected, make sure that the pam u2f module is installed            {include if "with-pam-u2f-2fa"}
  - users can then configure keys using the pamu2fcfg tool                                {include if "with-pam-u2f-2fa"}
                                                                                          {include if "with-mkhomedir"}
- with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module                       {include if "with-mkhomedir"}
  is present and oddjobd service is enabled and active                                    {include if "with-mkhomedir"}
  - systemctl enable --now oddjobd.service                                                {include if "with-mkhomedir"}
                                                                                          {include if "with-gssapi"}
- with-gssapi is selected, make sure that GSSAPI authentication is enabled in SSSD        {include if "with-gssapi"}
  - set pam_gssapi_services to a list of allowed services in /etc/sssd/sssd.conf          {include if "with-gssapi"}
  - see additional information in pam_sss_gss(8)                                          {include if "with-gssapi"}
                                                                                          {include if "with-tlog"}
- with-tlog is selected, make sure that session recording is enabled in SSSD              {include if "with-tlog"}
                                                                                          {include if "with-libvirt"}
- with-libvirt is selected, make sure that the libvirt NSS plugins are installed          {include if "with-libvirt"}
                                                                                          {include if "with-systemd-homed"}
- with-systemd-homed is selected, make sure that the system-homed service is enabled      {include if "with-systemd-homed"}
  - systemctl enable --now systemd-homed.service                                          {include if "with-systemd-homed"}
                                                                                          {include if "with-switchable-auth"}
- with-switchable-auth is selected, make sure to enable it in sssd.conf                   {include if "with-switchable-auth"}
  - set "pam_json_services = list-of-services" in [pam] section                           {include if "with-switchable-auth"}
                                                                                          {include if "with-gpupdate"}
- with-gpupdate is selected, make sure pam_oddjob_gpupdate module                         {include if "with-gpupdate"}
  and samba-gpupdate are present and oddjobd service is enabled and active                {include if "with-gpupdate"}
  - systemctl enable --now oddjobd.service                                                {include if "with-gpupdate"}