Bug#1051659: gdm3 45 does not detect users correctly with Yubikey connected

[Simon McVittie]

Control: retitle -1 gdm3 45 does not detect users correctly with Yubikey connected
Control: severity -1 important

On Sat, 16 Sep 2023 at 21:29:14 -0400, terroreek wrote:
> The issue seems to be having my Yubikey plugged in when GDM starts its looking
> for pam_sss.so.  If the pam module is missing one cannot login interactively. 
> I will try installing libpam-sss, to see if that revolves the issue.  However
> it can be fixed by removing my yubikey and plug it in after logging into gdm.  

This is probably the same bug as #1051785, which is a regression in
gdm3 version 45. If I understand correctly, this version integrated some
changes that were previously in Ubuntu, aiming to improve the ability to
use smartcards for authentication with gdm; but those changes go too far,
and break the ability to do non-smartcard authentication if related
PAM modules are not installed.

gdm should only do this if it can work: if the relevant PAM module
(pam_sss.so) is installed, and if the user/sysadmin has also configured
smartcard-based identities so that they can log in like this.

If you run as root

    update-alternatives --set gdm-smartcard /etc/pam.d/gdm-smartcard-sssd-or-password

does that restore previous functionality?

Marco: I think we should set the alternatives priority of
gdm-smartcard-sssd-or-password higher than gdm-smartcard-sssd-exclusive
in debian/gdm3.alternatives, unless there is a reason I'm not seeing
why that isn't viable.

    smcv