fedora-cosmic: add Kanidm Unix authentication

Install kanidm-unixd-clients/kanidm-clients, point /etc/kanidm/config at
auth.plabble.org, configure unixd (TPM-backed cache, pam_allowed_login_groups),
and set up PAM/nsswitch via an authselect custom profile (with a direct-file
fallback). Enable kanidm-unixd{,-tasks} and make unconfined_service_t
permissive until Kanidm ships an SELinux policy.

images/fedora-cosmic/custom.yaml

@@ -23,6 +23,10 @@ packages:
   - pam-u2f
   - token2-fido-bridge
 
+  # Kanidm Unix authentication (kanidm-unixd-clients pulls kanidm-clients).
+  - kanidm-unixd-clients
+  - kanidm-clients
+
 # Firefox is intentionally not part of the base system. It is preinstalled as a
 # per-user Flatpak on first login instead (see flatpaks.list).
 exclude-packages:
@@ -35,6 +39,13 @@ add-files:
   - ["flatpaks.list", "/usr/share/flatpak/flatpaks.list"]
   - ["50-token2-fido-bridge.preset", "/usr/lib/systemd/system-preset/50-token2-fido-bridge.preset"]
   - ["uhid.conf", "/usr/lib/modules-load.d/uhid.conf"]
+  # Kanidm client config and authselect profile sources.
+  - ["kanidm-config", "/etc/kanidm/config"]
+  - ["kanidm-unixd", "/etc/kanidm/unixd"]
+  - ["kanidm-system-auth", "/usr/share/fedora-cosmic/authselect/system-auth"]
+  - ["kanidm-password-auth", "/usr/share/fedora-cosmic/authselect/password-auth"]
+  - ["kanidm-nsswitch.conf", "/usr/share/fedora-cosmic/authselect/nsswitch.conf"]
+  - ["50-kanidm.preset", "/usr/lib/systemd/system-preset/50-kanidm.preset"]
 
 postprocess:
   # The upstream fedora.yaml removes the Google Chrome repo from the Fedora
@@ -52,3 +63,33 @@ postprocess:
     set -xeuo pipefail
     chmod 0755 /usr/libexec/flatpak-user-firstboot
     systemctl --user --global preset-all
+
+  # Kanidm PAM/nsswitch integration. Prefer an authselect profile; fall back to
+  # installing the files directly (and dropping the authselect symlinks) if
+  # authselect is unavailable in the compose environment.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    if ! (
+      set -euo pipefail
+      authselect create-profile kanidm -b local
+      install -m 0644 /usr/share/fedora-cosmic/authselect/system-auth \
+        /etc/authselect/custom/kanidm/system-auth
+      install -m 0644 /usr/share/fedora-cosmic/authselect/password-auth \
+        /etc/authselect/custom/kanidm/password-auth
+      install -m 0644 /usr/share/fedora-cosmic/authselect/nsswitch.conf \
+        /etc/authselect/custom/kanidm/nsswitch.conf
+      authselect select custom/kanidm --force
+    ); then
+      echo "authselect setup failed, installing PAM/nsswitch directly" >&2
+      rm -f /etc/pam.d/system-auth /etc/pam.d/password-auth /etc/nsswitch.conf
+      install -m 0644 /usr/share/fedora-cosmic/authselect/system-auth /etc/pam.d/system-auth
+      install -m 0644 /usr/share/fedora-cosmic/authselect/password-auth /etc/pam.d/password-auth
+      install -m 0644 /usr/share/fedora-cosmic/authselect/nsswitch.conf /etc/nsswitch.conf
+    fi
+
+  # Kanidm does not ship an SELinux policy yet; let the unixd daemons run.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    semanage permissive -a unconfined_service_t || true

images/fedora-cosmic/files/50-kanidm.preset

@@ -0,0 +1,3 @@
+# Kanidm Unix authentication daemons.
+enable kanidm-unixd.service
+enable kanidm-unixd-tasks.service

images/fedora-cosmic/files/kanidm-config

@@ -0,0 +1 @@
+uri = "https://auth.plabble.org"

images/fedora-cosmic/files/kanidm-nsswitch.conf

@@ -0,0 +1,14 @@
+passwd:     kanidm compat systemd
+group:      kanidm compat systemd
+shadow:     files
+hosts:      files dns myhostname
+services:   files
+netgroup:   files
+automount:  files
+aliases:    files
+ethers:     files
+gshadow:    files
+networks:   files dns
+protocols:  files
+publickey:  files
+rpc:        files

images/fedora-cosmic/files/kanidm-password-auth

@@ -0,0 +1,19 @@
+auth        required                                     pam_env.so
+auth        required                                     pam_faildelay.so delay=2000000
+auth        sufficient                                   pam_kanidm.so ignore_unknown_user
+auth        sufficient                                   pam_unix.so nullok
+auth        required                                     pam_deny.so
+
+account     sufficient                                   pam_kanidm.so
+account     required                                     pam_unix.so
+
+password    requisite                                    pam_pwquality.so
+password    sufficient                                   pam_unix.so yescrypt shadow nullok use_authtok
+password    required                                     pam_deny.so
+
+session     optional                                     pam_keyinit.so revoke
+session     required                                     pam_limits.so
+-session    optional                                     pam_systemd.so
+session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
+session     optional                                     pam_kanidm.so
+session     required                                     pam_unix.so

images/fedora-cosmic/files/kanidm-system-auth

@@ -0,0 +1,20 @@
+auth        required                                     pam_env.so
+auth        required                                     pam_faildelay.so delay=2000000
+auth        sufficient                                   pam_fprintd.so
+auth        sufficient                                   pam_kanidm.so ignore_unknown_user
+auth        sufficient                                   pam_unix.so nullok
+auth        required                                     pam_deny.so
+
+account     sufficient                                   pam_kanidm.so ignore_unknown_user
+account     required                                     pam_unix.so
+
+password    requisite                                    pam_pwquality.so
+password    sufficient                                   pam_unix.so yescrypt shadow nullok use_authtok
+password    required                                     pam_deny.so
+
+session     optional                                     pam_keyinit.so revoke
+session     required                                     pam_limits.so
+-session    optional                                     pam_systemd.so
+session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
+session     optional                                     pam_kanidm.so
+session     required                                     pam_unix.so

images/fedora-cosmic/files/kanidm-unixd

@@ -0,0 +1,20 @@
+version = "2"
+
+# Bind cached credentials to the local TPM when one is available.
+hsm_type = "tpm_if_possible"
+
+default_shell = "/bin/bash"
+home_prefix = "/home/"
+home_attr = "uuid"
+home_alias = "name"
+use_etc_skel = true
+selinux = true
+
+[kanidm]
+# Members of this Kanidm POSIX group are allowed to log in via PAM.
+pam_allowed_login_groups = ["unix_users"]
+
+# Token for the Kanidm service account used to resolve identities. Provision it
+# at /etc/kanidm/unixd_token (a single line) after install, or remove this line
+# if the server permits anonymous reads.
+service_account_token_path = "/etc/kanidm/unixd_token"