fix: ensure we fail authentication when user auth failed

[didrocks]

Authd has a high priority in the PAM stack. When we don’t ignore on purpose the authentication to pass to other modules, we should fail immediately it.
We thus mirror requisite with still allowing the none authentication access part to be skipped.

UDENG-3413

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.29%. Comparing base (05ca163) to head (676de03).
Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #406      +/-   ##
==========================================
- Coverage   84.40%   84.29%   -0.11%     
==========================================
  Files          77       77              
  Lines        6686     6691       +5     
  Branches       75       75              
==========================================
- Hits         5643     5640       -3     
- Misses        732      735       +3     
- Partials      311      316       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[3v1n0]

This is good.

GDM should be already ok with this. Maybe for making it more explicit also the debian/authd.gdm-authd.pam could be changed:

diff --git a/debian/authd.gdm-authd.pam b/debian/authd.gdm-authd.pam
index ea3ee6f6..7aed7ae9 100644
--- a/debian/authd.gdm-authd.pam
+++ b/debian/authd.gdm-authd.pam
@@ -7,6 +7,7 @@ auth    substack        common-auth
 
 auth    requisite       pam_nologin.so
 auth    optional        pam_gnome_keyring.so
+auth    sufficient      pam_permit.so
 
 account [default=ignore success=ok user_unknown=ignore]	pam_authd.so
 # This is potentially loading pam_authd.again but we've checks in AcctMgmt() to
@@ -31,6 +32,9 @@ session required        pam_limits.so
 session required        pam_env.so readenv=1
 session required        pam_env.so readenv=1 envfile=/etc/default/locale
 @include common-session
+
 session optional        pam_mkhomedir.so
 session optional        pam_gnome_keyring.so auto_start
+session sufficient      pam_permit.so
+
 @include common-password

[didrocks]

Do you mind adding a separate PR for the gdm part? Let’s merge that in in between.