I'll nitpick :)

The use cases section is empty. If you feel the problem statement explains the use case enough, just remove the header, please.

Add yourself as the author down below.

Does it make sense to add anything to the How to debug section? I can add something which I used to debug my setup if you want, tl;dr it was beneficial to scroll up to the p11_child output and the processing of the output by the pam responder which showed how the certificates are processed. Also, the file provider logs showed how is the cert (during they by-cert request) converted into the sysdb filter.

And one final idea which is not connected to this patch per se, but I thought about it when I read this patch. By default, SSSD is running on modern fedora distributions but the files domain has a non-discoverable name (implicit_files). I wonder how to make life easier for admins that just want to drop a snippet for the local domain - we can document how is the default domain names, we should fix sssctl-domain-list to list the local domain (currently it doesn't because it's not defined in the config file). Anything else we can do?

Hi Jakub,

thank you for the review. I think I addressed all your comments in the latest version.

About Anything else we can do?, I wonder if it would be worth to add some magic so that if there is a config snippet with a certmap rule for the implicit_files domain the pam responder and pam_cert_auth are enable by default if there is no sssd.conf. Since the mapping rule has to be added manually I think it is ok to initially add a basic sssd.conf as described on the desing page.

Yes, this would help, but I was wondering how to make the /name/ implicit files more discoverable by admins. We can just document this in the sssd-smartcard design page, but unless you can think about running e.g. ps to see the sssd_be processes running, it is hard to find out what the domain must be named as.

Yes, this would help, but I was wondering how to make the /name/ implicit files more discoverable by admins. We can just document this in the sssd-smartcard design page, but unless you can think about running e.g. ps to see the sssd_be processes running, it is hard to find out what the domain must be named as.

Maybe it can be mentioned explicitly in the sssd.conf man page with the enable_files_domain option? Additionally It can be mentioned in the sssd man page with the config option.

OK, that's a good suggestion. Since Tomas is already improving some documentation about the files provider, I asked him to do these changes also in the scope of sssd ticket #3500. I also added a small note to the ticket about the sssd-smartcards man page.

I did some minor changes like moving the page to the 2.0 section, fixing some typos and rendering some works in monospace font.

The page was pushed to master as 15f8b1dc24d652488d451310105eb94fa0d87919

I will regenerate the HTML docs later today once I push PR #72