Hi,

to put it a bit more general this ticket is about requiring Smartcard authentication but not for all users and maybe for not all services where Smartcard authentication might be possible. This requires some design (maybe the prompting configuration can be used at least for parts of it) and it should be checked if there should be some interactions with authconfig and how GDM will handle this feature.

Changing this ticket to an RFE.

bye,
Sumit

Comment from Sumit:
```
Currently pam_sss does not handle a user called "root" at
all, but if Smartcard authentication is enforced and "root" should log
in with a Smartcard as well (yes, the opposite of what is asked in the
ticket) who else then SSSD should handle it. So from the SSSD side we
need a special case with Smartcard authentication for the root user.

If this is fixed we can decide if it would be better to configure if the
root use should use Smartcard or password if Smartcard authentication is
required in sssd.conf or in the pam configuration, i.e. in authselect.
```

At this stage this RFE should target RHEL9. Once/if implemented, backport to RHEL8 might be considered.

The issue can be addressed by following line:

~~~
auth        [success=5 default=ignore]                   pam_succeed_if.so uid eq 0 quiet
~~~


An example auth type in /etc/pam.d/system-auth:

~~~
auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        [success=5 default=ignore]                   pam_succeed_if.so uid eq 0 quiet
auth        [success=1 default=ignore]                   pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid
auth        [success=done ignore=ignore default=die]     pam_sss.so require_cert_auth ignore_authinfo_unavail
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        [default=2 ignore=ignore success=ok]         pam_localuser.so
auth        [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth
auth        sufficient                                   pam_unix.so nullok
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        sufficient                                   pam_sss.so forward_pass
auth        required                                     pam_deny.so
~~~

You can save it as custom authselect profile [1]


Should there be a strong business justification for creating a new authselect feature like  `with-smartcard with-root-excepted`

Please file a new RFE bug against authselect


1. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel#creating-and-deploying-your-own-authselect-profile_configuring-user-authentication-using-authselect