Let SSSD to decide whether missing name in PAM conversation of certificate-based authentication is allowed or not based on the certificate mapping properties, not upfront from pam_sss configuration.

I believe current setup is hurting admin experience due to the need to set allow_missing_name option on all machines where and when there is a need to allow role-based logon. SSSD should already know that missing name in PAM exchange is OK for smartcard-based logon if certificate mapping allows that. PAM module (pam_sss) config should not be involved.

Sumit's point is that PAM config modification is needed anyway to enable pam_sss and disable pam_pkcs11 so setting option is "OK". However, the option itself is not required because logic-wise (not code-wise, this is what this RFE is about to change) SSSD can discover whether allow_missing_name behavior is required or not once it finds out that pam_sss performs smartcard authentication. So option itself becomes redundant, only to avoid contacting SSSD. However, if such option is always specified in pam_sss config, why can't be its behavior be default at all?