If anaconda decides to enable fingerprint authentication during installation, it uses `authselect select`, not `authselect enable`. This overwrites the entire config, overriding existing choices.

A specific problem here is that if `nss-mdns` is in the installed package set, during the package install transaction, its %posttrans runs `authselect enable-feature with-mdns4` to enable mdns lookups. But if anaconda then decides to enable fingerprint authentication, it runs `authselect select sssd with-fingerprint with-silent-lastlog --force`, which turns mdns lookups off again. See discussion in https://bugzilla.redhat.com/show_bug.cgi?id=2056927 .

It looks to me like this is kind of a hangover from a time when we expected anaconda to always run authconfig/authselect and set a default config, but it no longer does that; AFAICT, the 'expected' setting of the default config happens in the %posttrans of authselect-libs:

# If we are upgrading from pre authselect-1.3.0 or this is a new installation
# select the default configuration.
if [ -f /var/lib/rpm-state/authselect.force ]; then
    /usr/bin/authselect select sssd with-silent-lastlog --force $NOBACKUP &> /dev/null
    /usr/bin/rm -f /var/lib/rpm-state/authselect.force
fi

(there's earlier logic which creates `/var/lib/rpm-state/authselect.force` if this is a frehs install). anaconda these days is overall designed to not necessarily run authselect at all (only if the kickstart specifies it)...but if it decides to enable fingerprint authentication, it does this.

So I think it may be OK to change anaconda to do `authselect enable-feature with-fingerprint` instead, which should I think preserve any existing config set by authselect and nss-mdns during the package install transaction...