446c6c8 ipa-advise: configure pam_cert_auth=True for smart card on client

Authored and Committed by frenaud 5 years ago
    ipa-advise: configure pam_cert_auth=True for smart card on client
    
    ipa-advise config-client-for-smart-card-auth is now using authselect
    instead of authconfig, but authselect enable-feature with-smartcard
    does not set pam_cert_auth=True in /etc/sssd/sssd.conf.
    As a result, smart card auth on a client fails.
    The fix adds a step in ipa-advise to configure pam_cert_auth=True.
    
    The fix also forces the use of python3 interpreter, and handles
    newer versions of SSSD which use OpenSSL instead of NSS (the trusted
    CA certs must be put into /etc/sssd/pki/sssd_auth_ca_db.pem
    
    Fixes https://pagure.io/freeipa/issue/7532
    
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>