cfg_rules: add pwfield to allowed_domain_options

[mmatsuya]

Problem

pwfield was made configurable per-domain in commit c778c36
(CONFDB: Make pwfield configurable per-domain, 2016), but
cfg_rules.ini was never updated. As a result, sssctl config-check
rejects pwfield in any [domain/*] section:

[rule/allowed_domain_options]: Attribute 'pwfield' is not allowed in
section 'domain/local'. Check for typos.

This surfaces in practice when a test or deployment sets pwfield=x
in a proxy domain with proxy_lib_name=files to work around the
*-vs-x issue documented in #5129. Even though SSSD reads and
respects the value at runtime (via confdb.c), the config validator
incorrectly rejects it.

Fix

Add pwfield to [rule/allowed_domain_options] in cfg_rules.ini,
placing it alongside the other NSS override options (filter_users,
filter_groups).

Testing

Verified that sssctl config-check no longer reports an error for
a [domain/local] section containing pwfield=x.

Resolves: #5129

[alexey-tikhonov]

Out of curiosity:

This surfaces in practice when a test or deployment sets pwfield=x
in a proxy domain with proxy_lib_name=files

-- this should be a default: “x” (proxy domain with nss_files and sssd-shadowutils target)?
Doesn't it work?

[alexey-tikhonov]

In general, this is correct fix, but I think we also need to update the man page, that currently mentions this option only in "NSS configuration options" section.

[mmatsuya]

Out of curiosity:

This surfaces in practice when a test or deployment sets pwfield=x
in a proxy domain with proxy_lib_name=files

-- this should be a default: “x” (proxy domain with nss_files and sssd-shadowutils target)? Doesn't it work?

The auto-set of pwfield=x only applies when proxy_pam_target=sssd-shadowutils (since ffb9ad1).

In this test case covered by sssd-test-framework#265, local() uses proxy_pam_target=system-auth (standard PAM stack, not sssd-shadowutils). With that target, SSSD proxy returns * for the password field instead of x. pam_unix then treats the account as locked, causing SSH authentication to fail for local users. Setting pwfield=x explicitly in the domain section bypasses this and restores the correct behavior. This is the scenario the fix is intended to cover.

NOTE: I am going to reopen sssd-test-framework#265 after this PR was merged.

[mmatsuya]

In general, this is correct fix, but I think we also need to update the man page, that currently mentions this option only in "NSS configuration options" section.

I will update the man page as well.

[mmatsuya]

Hi @alexey-tikhonov, I updated part of the existing pwfield (string) in man page.

[sssd-bot]

The pull request was accepted by @alexey-tikhonov with the following PR CI status:

---

🟢 CodeQL (success)
🟢 osh-diff-scan:fedora-rawhide-x86_64:upstream (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)
🟢 testing-farm:centos-stream-10-x86_64:upstream (success)
🔴 testing-farm:fedora-43-x86_64:upstream (failure)
🔴 testing-farm:fedora-44-x86_64:upstream (failure)
🔴 testing-farm:fedora-rawhide-x86_64:upstream (failure)
🟢 Build / freebsd (success)
🟢 Build / make-distcheck (success)
🟢 ci / intgcheck (centos-10) (success)
🟢 ci / intgcheck (fedora-43) (success)
🟢 ci / intgcheck (fedora-44) (success)
🟢 ci / intgcheck (fedora-45) (success)
🟢 ci / prepare (success)
🔴 ci / system (centos-10) (failure)
🟢 ci / system (fedora-43) (success)
🟢 ci / system (fedora-44) (success)
🔴 ci / system (fedora-45) (failure)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.