@sbose, You asked me to send an updated version of patch from the old thread
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org/thread/FQWOBQV6FFCBKZS2EXKIJU74473E7R7Y/#YYTNQO5ZTHXHG6Q5FDHZBBW4M37PRYEA

Here you are. And thank you for a reminder.

Thank you for rebasing the patch and fixing the typos. The patch still works as expected and I'm waiting for the CI to finish.

I still think it would be worth generate a syslog message in case get_sc_services() fails because it most probably will indicate that there is some issue/typo in sssd.conf.

Thank you for rebasing the patch and fixing the typos. The patch still works as expected and I'm waiting for the CI to finish.
I still think it would be worth generate a syslog message in case get_sc_services() fails because it most probably will indicate that there is some issue/typo in sssd.conf.

@sbose, I probably missed that comment in old thread. I used just SSSDBG_CRIT_FAILURE. But feel free to propose some reasonable syslog message. I' fine with squasging such change.

What about "Failed to evaluate pam_p11_allowed_services option, please check for typos in the SSSD configuration"?

As the author of the patch mentioned "I' fine with squasging such change." the following change, suggested by @sbose, has been squashed in the patch before pushing:

diff --git a/src/responder/pam/pamsrv_p11.c b/src/responder/pam/pamsrv_p11.c
index 82228d30e..ddb2def7e 100644
--- a/src/responder/pam/pamsrv_p11.c
+++ b/src/responder/pam/pamsrv_p11.c
@@ -391,6 +391,9 @@ bool may_do_cert_auth(struct pam_ctx *pctx, struct pam_data *pd)
             DEBUG(SSSDBG_CRIT_FAILURE,
                   "Failed to get p11 allowed services %d[%s]",
                   ret, sss_strerror(ret));
+            sss_log(SSS_LOG_ERR,
+                    "Failed to evaluate pam_p11_allowed_services option, "
+                    "please check for typos in the SSSD configuration");
             return false;
         }
     }

Commit 93caaf29 fixes this pull-request

master:
93caaf2