Update sssd_enable_smartcards & sssd_offline_cred_expiration

linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml

@@ -34,6 +34,19 @@
     create: yes
     mode: 0600
 
+- name: Find all the conf files inside /etc/sssd/conf.d/
+  find:
+    paths: "/etc/sssd/conf.d/"
+    patterns: "*.conf"
+  register: sssd_conf_d_files
+
+- name: Fix pam_cert_auth configuration in /etc/sssd/conf.d/
+  ansible.builtin.replace:
+    path: "{{ item.path }}"
+    regexp: '[^#]*pam_cert_auth.*'
+    replace: 'pam_cert_auth = True'
+  with_items: "{{ sssd_conf_d_files.files }}"
+
 {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9"] %}}
 - name: '{{{ rule_title }}} - Check if system relies on authselect'
   ansible.builtin.stat:

linux_os/guide/services/sssd/sssd_enable_smartcards/bash/shared.sh

@@ -9,7 +9,7 @@
 OLD_UMASK=$(umask)
 umask u=rw,go=
 
-{{{ bash_ensure_ini_config("/etc/sssd/sssd.conf", "pam", "pam_cert_auth", "True") }}}
+{{{ bash_ensure_ini_config("/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf", "pam", "pam_cert_auth", "True") }}}
 
 umask $OLD_UMASK
 

linux_os/guide/services/sssd/sssd_enable_smartcards/oval/shared.xml

@@ -17,14 +17,19 @@
   comment="tests the value of pam_cert_auth setting in the /etc/sssd/sssd.conf file"
   id="test_sssd_enable_smartcards" version="1">
     <ind:object object_ref="obj_sssd_enable_smartcards" />
+    <ind:state state_ref="state_sssd_enable_smartcards" />
   </ind:textfilecontent54_test>
 
-  <ind:textfilecontent54_object id="obj_sssd_enable_smartcards" version="1">
-    <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*(?i)true\s*$</ind:pattern>
+  <ind:textfilecontent54_object id="obj_sssd_enable_smartcards" version="2">
+    <ind:filepath operation="pattern match">/etc/sssd/(sssd\.conf|conf.d/[^/]+\.conf)</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*(\w+)\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
+  <ind:textfilecontent54_state id="state_sssd_enable_smartcards" version="1">
+    <ind:subexpression operation="pattern match">(?i)true</ind:subexpression>
+  </ind:textfilecontent54_state>
+
   {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9"] %}}
   <ind:textfilecontent54_test check="all" check_existence="all_exist"
   comment="tests the presence of try_cert_auth or require_cert_auth in /etc/pam.d/smartcard-auth"

linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_smartcard_enabled_conf_d.pass.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# packages = authselect,sssd
+# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
+
+SSSD_FILE="/etc/sssd/conf.d/unused.conf"
+echo "[pam]" > $SSSD_FILE
+echo "pam_cert_auth = True" >> $SSSD_FILE
+
+authselect select sssd --force
+authselect enable-feature with-smartcard
+authselect apply-changes

linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_sssd_parameter_false_conf_d.fail.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# packages = authselect,sssd
+# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
+
+SSSD_FILE="/etc/sssd/conf.d/unused.conf"
+echo "[pam]" > $SSSD_FILE
+echo "pam_cert_auth = False" >> $SSSD_FILE
+
+authselect select sssd --force
+authselect enable-feature with-smartcard
+authselect apply-changes

linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml

@@ -33,3 +33,16 @@
     value: 1
     create: yes
     mode: 0600
+
+- name: Find all the conf files inside /etc/sssd/conf.d/
+  find:
+    paths: "/etc/sssd/conf.d/"
+    patterns: "*.conf"
+  register: sssd_conf_d_files
+
+- name: Fix offline_credentials_expiration configuration in /etc/sssd/conf.d/
+  ansible.builtin.replace:
+    path: "{{ item.path }}"
+    regexp: '[^#]*offline_credentials_expiration.*'
+    replace: 'offline_credentials_expiration = 1'
+  with_items: "{{ sssd_conf_d_files.files }}"

linux_os/guide/services/sssd/sssd_offline_cred_expiration/bash/shared.sh

@@ -9,6 +9,6 @@
 OLD_UMASK=$(umask)
 umask u=rw,go=
 
-{{{ bash_ensure_ini_config("/etc/sssd/sssd.conf", "pam", "offline_credentials_expiration", "1") }}}
+{{{ bash_ensure_ini_config("/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf", "pam", "offline_credentials_expiration", "1") }}}
 
 umask $OLD_UMASK

linux_os/guide/services/sssd/sssd_offline_cred_expiration/oval/shared.xml

@@ -14,12 +14,17 @@
   comment="tests the value of offline_credentials_expiration setting in the /etc/sssd/sssd.conf file"
   id="test_sssd_offline_cred_expiration" version="1">
     <ind:object object_ref="obj_sssd_offline_cred_expiration" />
+    <ind:state state_ref="state_sssd_offline_cred_expiration" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_sssd_offline_cred_expiration" version="1">
     <ind:filepath operation="pattern match">^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*1\s*(?:#.*)?$</ind:pattern>
+    <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*(\d+)\s*(?:#.*)?$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_sssd_offline_cred_expiration" version="1">
+    <ind:subexpression>1</ind:subexpression>
+  </ind:textfilecontent54_state>
   {{% if product in ["ol8", "rhel8"] %}}
   <ind:textfilecontent54_test check="all" check_existence="any_exist"
   comment="tests the value of cache_credentials setting in the /etc/sssd/sssd.conf file"

linux_os/guide/services/sssd/sssd_offline_cred_expiration/rule.yml

@@ -64,7 +64,7 @@ ocil: |-
     If "cache_credentials" is set to "false" or is missing no further checks are required.<br/>
     {{% endif %}}
     To verify that SSSD expires offline credentials, run the following command:
-    <pre>$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf</pre>
+    <pre>$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf</pre>
     If configured properly, output should be
     <pre>offline_credentials_expiration = 1</pre>
 

linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/correct_value_conf_d.pass.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+source common.sh
+
+SSSD_CONF_D_FILE="/etc/sssd/conf.d/unused.conf"
+
+echo -e "[pam]\noffline_credentials_expiration = 1" >> $SSSD_CONF_D_FILE
+
+echo -e "[domain/EXAMPLE]\ncache_credentials = true" >> $SSSD_CONF

linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/wrong_value_conf_d.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+source common.sh
+
+SSSD_CONF_D_FILE="/etc/sssd/conf.d/unused.conf"
+
+echo -e "[pam]\noffline_credentials_expiration = 0" >> $SSSD_CONF_D_FILE
+
+echo -e "[domain/EXAMPLE]\ncache_credentials = true" >> $SSSD_CONF