[autobackport: sssd-2-9] pac: fix issue with pac_check=no_check

[sssd-bot]

This is an automatic backport of PR#8318 pac: fix issue with pac_check=no_check to branch sssd-2-9, created by @sumit-bose.

Please make sure this backport is correct.

Note

The commits were cherry-picked without conflicts.

You can push changes to this pull request

git remote add sssd-bot git@github.com:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr8318-to-sssd-2-9
git checkout SSSD-sssd-backport-pr8318-to-sssd-2-9
git push sssd-bot SSSD-sssd-backport-pr8318-to-sssd-2-9 --force

---

Original commits
c123201 - pac: fix issue with pac_check=no_check

Backported commits

• b2bd848 - pac: fix issue with pac_check=no_check

---

Original Pull Request Body

So far SSSD expected that the PAC contains the logon_info buffer even if PAC checks are disabled with the 'no_check' option. This causes issues with PACs issues by MIT Kerberos KDCs which do not contain this buffer. This patches makes sure that the logon_info is not expected if 'no_check' is set and adds some clarifications to the man page.

Resolves: #8300

[gemini-code-assist]

Code Review

This pull request is a backport of a fix for an issue where SSSD would incorrectly require the PAC LOGON_INFO buffer even when PAC checks were disabled via pac_check=no_check. This caused problems with PACs from MIT Kerberos KDCs. The change in src/providers/ad/ad_pac_common.c correctly skips the check for the LOGON_INFO buffer when pac_check_opts is 0, which aligns with the no_check setting. The documentation in src/man/sssd.conf.5.xml is also updated to clarify which KDCs are expected to provide the necessary PAC data for checks. The changes are correct and effectively resolve the issue.

[aplopez]

ACK

[sssd-bot]

The pull request was accepted by @alexey-tikhonov with the following PR CI status:

---

🟢 CodeQL (success)
🟢 rpm-build:centos-stream-9-x86_64:upstream (success)
🟢 Build / make-distcheck (success)
🟢 ci / prepare (success)
🟢 ci / system (centos-9) (success)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.