authselect · thalman · Jun 3, 2026 · May 28, 2026 · May 28, 2026 · May 28, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,194 @@
+name: "ci"
+on:
+  push:
+    branches: [1.2.x]
+  pull_request:
+    branches: [1.2.x]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  ostree:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        path: authselect
+
+    - name: Setup containers
+      uses: SSSD/sssd-ci-containers/actions/setup@master
+      with:
+        path: sssd-ci-containers
+        tag: centos-9
+        override: |
+          services:
+            client:
+              image: ${REGISTRY}/ci-client-devel:${TAG}
+              shm_size: 4G
+              tmpfs:
+              - /dev/shm
+              volumes:
+              - ../authselect:/authselect:rw
+
+    - name: Install build dependencies on the client
+      uses: SSSD/sssd-ci-containers/actions/exec@master
+      with:
+        log-file: ostree-dependencies.log
+        working-directory: /authselect
+        user: root
+        where: client
+        script: |
+          #!/bin/bash
+          set -ex
+
+          scripts/auto install-build-deps
+
+    - name: Build authselect RPMs on the client
+      uses: SSSD/sssd-ci-containers/actions/exec@master
+      with:
+        log-file: ostree-build.log
+        working-directory: /authselect
+        where: client
+        script: |
+          #!/bin/bash
+          set -ex
+          autoreconf -if && ./configure --enable-silent-rules
+          make rpms
+
+    - name: Create ostree marker (mimic required ostree detection)
+      uses: SSSD/sssd-ci-containers/actions/exec@master
+      with:
+        user: root
+        where: client
+        script: |
+          #!/bin/bash
+          set -ex
+          mkdir -p /run
+          touch /run/ostree-booted
+
+    - name: Install authselect RPMs on the client
+      uses: SSSD/sssd-ci-containers/actions/exec@master
+      with:
+        log-file: ostree-install.log
+        working-directory: /authselect
+        user: root
+        where: client
+        script: |
+          #!/bin/bash
+          set -ex
+
+          # Must you rpm as dnf blocks installation in fake ostree mode
+          rpm -U rpmbuild/RPMS/*/*.rpm
+
+    - name: Verify that vendor profiles were created
+      uses: SSSD/sssd-ci-containers/actions/exec@master
+      with:
+        log-file: ostree-verify-vendor.log
+        user: root
+        where: client
+        script: |
+          #!/bin/bash
+          set -ex
+
+          # Check that vendor profiles directory exists
+          test -d /usr/share/authselect/vendor
+
+          # Check that vendor profiles were created for each default profile
+          for profile in sssd winbind nis minimal; do
+            if [ -d "/usr/share/authselect/default/$profile" ]; then
+              echo "Checking vendor profile: $profile"
+              test -d "/usr/share/authselect/vendor/$profile" || {
+                echo "ERROR: Vendor profile $profile not found"
+                exit 1
+              }
+
+              # Verify nsswitch.conf exists in vendor profile
+              nsswitch="/usr/share/authselect/vendor/$profile/nsswitch.conf"
+              test -f "$nsswitch" || {
+                echo "ERROR: nsswitch.conf not found in vendor/$profile"
+                exit 1
+              }
+
+              # Verify "with-altfiles" template conditional was removed
+              if grep -q "with-altfiles" "$nsswitch"; then
+                echo "ERROR: 'with-altfiles' template conditional still present in $nsswitch"
+                cat "$nsswitch"
+                exit 1
+              fi
+
+              echo "Vendor profile $profile: OK (with-altfiles conditional removed)"
+            fi
+          done
+
+    - name: Verify altfiles is enabled in /etc/nsswitch.conf
+      uses: SSSD/sssd-ci-containers/actions/exec@master
+      with:
+        log-file: ostree-verify-altfiles.log
+        user: root
+        where: client
+        script: |
+          #!/bin/bash
+          set -ex
+
+          echo "Checking /etc/nsswitch.conf for altfiles..."
+          cat /etc/nsswitch.conf
+
+          # Check altfiles is present on passwd: line
+          if ! grep "^passwd:" /etc/nsswitch.conf | grep -q "altfiles"; then
+            echo "ERROR: 'altfiles' not found on passwd: line in /etc/nsswitch.conf"
+            exit 1
+          fi
+
+          # Check altfiles is present on group: line
+          if ! grep "^group:" /etc/nsswitch.conf | grep -q "altfiles"; then
+            echo "ERROR: 'altfiles' not found on group: line in /etc/nsswitch.conf"
+            exit 1
+          fi
+
+          echo "SUCCESS: altfiles present on passwd: and group: lines in /etc/nsswitch.conf"
+
+    - name: Verify altfiles is enabled with with-group-merging /etc/nsswitch.conf
+      uses: SSSD/sssd-ci-containers/actions/exec@master
+      with:
+        log-file: ostree-verify-altfiles-after.log
+        user: root
+        where: client
+        script: |
+          #!/bin/bash
+          set -ex
+
+          authselect enable-feature with-group-merging
+
+          echo "Checking /etc/nsswitch.conf for altfiles after enabling with-group-merging..."
+          cat /etc/nsswitch.conf
+
+          # Check altfiles is present on passwd: line
+          if ! grep "^passwd:" /etc/nsswitch.conf | grep -q "altfiles"; then
+            echo "ERROR: 'altfiles' not found on passwd: line in /etc/nsswitch.conf after feature change"
+            exit 1
+          fi
+
+          # Check altfiles is present on group: line
+          if ! grep "^group:" /etc/nsswitch.conf | grep -q "altfiles"; then
+            echo "ERROR: 'altfiles' not found on group: line in /etc/nsswitch.conf after feature change"
+            exit 1
+          fi
+
+          echo "SUCCESS: altfiles still present on passwd: and group: lines in /etc/nsswitch.conf after feature change"
+
+    - name: Upload artifacts
+      if: always()
+      uses: actions/upload-artifact@v4
+      with:
+        if-no-files-found: ignore
+        name: ostree
+        path: |
+          ostree-dependencies.log
+          ostree-build.log
+          ostree-install.log
+          ostree-verify-vendor.log
+          ostree-verify-altfiles.log
+          ostree-verify-altfiles-after.log
diff --git a/profiles/minimal/README b/profiles/minimal/README
@@ -38,6 +38,11 @@ with-pwhistory::
 with-altfiles::
     Use nss_altfiles for passwd and group nsswitch databases.
 
+with-group-merging::
+    Enable merging of group records from multiple NSS sources using
+    [SUCCESS=merge]. Required for services like systemd-homed that
+    advertise users as part of system groups.
+
 without-nullok::
     Do not add nullok parameter to pam_unix.
 

diff --git a/profiles/minimal/nsswitch.conf b/profiles/minimal/nsswitch.conf
@@ -1,7 +1,8 @@
 aliases:    files                                       {exclude if "with-custom-aliases"}
 automount:  files                                       {exclude if "with-custom-automount"}
 ethers:     files                                       {exclude if "with-custom-ethers"}
-group:      files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }systemd {exclude if "with-custom-group"}
+group:      files {if "with-altfiles":altfiles }systemd {exclude if "with-custom-group"} {exclude if "with-group-merging"}
+group:      files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }systemd {exclude if "with-custom-group"} {include if "with-group-merging"}
 hosts:      resolve [!UNAVAIL=return] files myhostname dns {exclude if "with-custom-hosts"}
 initgroups: files                                       {exclude if "with-custom-initgroups"}
 netgroup:   files                                       {exclude if "with-custom-netgroup"}

diff --git a/profiles/nis/README b/profiles/nis/README
@@ -51,11 +51,19 @@ with-pamaccess::
 with-pwhistory::
     Enable pam_pwhistory module for local users.
 
+with-altfiles::
+    Use nss_altfiles for passwd and group nsswitch databases.
+
 with-nispwquality::
     If this option is set pam_pwquality module will check password quality
     for NIS users as well as local users during password change. Without this
     option only local users passwords are checked.
 
+with-group-merging::
+    Enable merging of group records from multiple NSS sources using
+    [SUCCESS=merge]. Required for services like systemd-homed that
+    advertise users as part of system groups.
+
 without-nullok::
     Do not add nullok parameter to pam_unix.
 

diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
@@ -1,12 +1,13 @@
 aliases:    files nis                   {exclude if "with-custom-aliases"}
 automount:  files nis                   {exclude if "with-custom-automount"}
 ethers:     files nis                   {exclude if "with-custom-ethers"}
-group:      files [SUCCESS=merge] nis [SUCCESS=merge] systemd           {exclude if "with-custom-group"}
+group:      files {if "with-altfiles":altfiles }nis systemd           {exclude if "with-custom-group"} {exclude if "with-group-merging"}
+group:      files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }nis [SUCCESS=merge] systemd           {exclude if "with-custom-group"} {include if "with-group-merging"}
 hosts:      resolve [!UNAVAIL=return] files nis myhostname dns {exclude if "with-custom-hosts"}
 initgroups: files nis                   {exclude if "with-custom-initgroups"}
 netgroup:   files nis                   {exclude if "with-custom-netgroup"}
 networks:   files nis                   {exclude if "with-custom-networks"}
-passwd:     files nis systemd           {exclude if "with-custom-passwd"}
+passwd:     files {if "with-altfiles":altfiles }nis systemd           {exclude if "with-custom-passwd"}
 protocols:  files nis                   {exclude if "with-custom-protocols"}
 publickey:  files nis                   {exclude if "with-custom-publickey"}
 rpc:        files nis                   {exclude if "with-custom-rpc"}

diff --git a/profiles/sssd/README b/profiles/sssd/README
@@ -80,11 +80,19 @@ with-pamaccess::
 with-pwhistory::
     Enable pam_pwhistory module for local users.
 
+with-altfiles::
+    Use nss_altfiles for passwd and group nsswitch databases.
+
 with-files-domain::
     If set, SSSD will be contacted before "files" when resolving users and
     groups. The order in nsswitch.conf will be set to "sss files" instead of
     "files sss" for passwd and group maps.
 
+with-group-merging::
+    Enable merging of group records from multiple NSS sources using
+    [SUCCESS=merge]. Required for services like systemd-homed that
+    advertise users as part of system groups.
+
 with-files-access-provider::
     If set, account management for local users is handled also by pam_sss. This
     is needed if there is an explicitly configured domain with id_provider=files

diff --git a/profiles/sssd/nsswitch.conf b/profiles/sssd/nsswitch.conf
@@ -1,5 +1,6 @@
-passwd:     {if "with-files-domain":sss files|files sss} systemd   {exclude if "with-custom-passwd"}
-group:      {if "with-files-domain":sss [SUCCESS=merge] files [SUCCESS=merge]|files [SUCCESS=merge] sss [SUCCESS=merge]} systemd   {exclude if "with-custom-group"}
+passwd:     {if "with-files-domain":sss }files {if "with-altfiles":altfiles }{if not "with-files-domain":sss }systemd   {exclude if "with-custom-passwd"}
+group:      {if "with-files-domain":sss }files {if "with-altfiles":altfiles }{if not "with-files-domain":sss }systemd   {exclude if "with-custom-group"} {exclude if "with-group-merging"}
+group:      {if "with-files-domain":sss [SUCCESS=merge] }files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }{if not "with-files-domain":sss [SUCCESS=merge] }systemd   {exclude if "with-custom-group"} {include if "with-group-merging"}
 netgroup:   sss files           {exclude if "with-custom-netgroup"}
 automount:  sss files           {exclude if "with-custom-automount"}
 services:   sss files           {exclude if "with-custom-services"}

diff --git a/profiles/winbind/README b/profiles/winbind/README
@@ -66,6 +66,14 @@ with-pamaccess::
 with-pwhistory::
     Enable pam_pwhistory module for local users.
 
+with-altfiles::
+    Use nss_altfiles for passwd and group nsswitch databases.
+
+with-group-merging::
+    Enable merging of group records from multiple NSS sources using
+    [SUCCESS=merge]. Required for services like systemd-homed that
+    advertise users as part of system groups.
+
 without-nullok::
     Do not add nullok parameter to pam_unix.
 

diff --git a/profiles/winbind/nsswitch.conf b/profiles/winbind/nsswitch.conf
@@ -1,2 +1,3 @@
-passwd:     files winbind systemd    {exclude if "with-custom-passwd"}
-group:      files [SUCCESS=merge] winbind [SUCCESS=merge] systemd    {exclude if "with-custom-group"}
+passwd:     files {if "with-altfiles":altfiles }winbind systemd    {exclude if "with-custom-passwd"}
+group:      files {if "with-altfiles":altfiles }winbind systemd    {exclude if "with-custom-group"} {exclude if "with-group-merging"}
+group:      files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }winbind [SUCCESS=merge] systemd    {exclude if "with-custom-group"} {include if "with-group-merging"}
diff --git a/rpm/authselect.spec.in b/rpm/authselect.spec.in
@@ -291,7 +291,7 @@ fi
 if test -e /run/ostree-booted; then
     for PROFILE in `ls %{_datadir}/authselect/default`; do
         %{_bindir}/authselect create-profile $PROFILE --vendor --base-on $PROFILE --symlink-pam --symlink-dconf --symlink=REQUIREMENTS --symlink=README &> /dev/null
-        %__sed -ie "s/^\(passwd\|group\):\(.*\)systemd\(.*\)/\1:\2systemd altfiles\3/g" %{_datadir}/authselect/vendor/$PROFILE/nsswitch.conf &> /dev/null
+        %__sed -i -e 's/{if "with-altfiles":\([^}]\+\)}/\1/g' %{_datadir}/authselect/vendor/$PROFILE/nsswitch.conf &> /dev/null
     done
 fi
 

diff --git a/scripts/commands/install-build-deps.sh b/scripts/commands/install-build-deps.sh
@@ -11,7 +11,7 @@ fi
 . /etc/os-release
 
 case "$ID" in
-  fedora)
+  fedora|centos)
     [ ! -f "rpm/authselect.spec.in" ] && die "Missing file: rpm/authselect.spec.in"
     [ -f "authselect.spec" ] && die "./authselect.spec already exist, delete it to continue."