Allow LDAP users that are not visible to pam_unix (bsc#1256791)

[nadvornik]

What does this PR change?

This PR modifies pam.d/susemanager-account to not fail on users that are unknown to pam_unix.
The users can be configured in LDAP as Uyuni-only users, they do not have to be visible to the OS via pam_unix.

[success=ok new_authtok_reqd=ok ignore=ignore user_unknown=ignore default=die] is the same as requisite, except for user_unknown=ignore

Codespace

Check if you already have a running container clicking on

GUI diff

No difference.

• DONE

Documentation

• No documentation needed: bugfix

• DONE

Test coverage

ℹ️ If a major new functionality is added, it is strongly recommended that tests for the new functionality are added to the Cucumber test suite

• No tests: add explanation

• DONE

Links

Issue(s): https://github.com/SUSE/spacewalk/issues/29438
https://bugzilla.suse.com/show_bug.cgi?id=1256791
Port(s): # add downstream PR(s), if any

• DONE

Changelogs

Make sure the changelogs entries you are adding are compliant with https://github.com/uyuni-project/uyuni/wiki/Contributing#changelogs and https://github.com/uyuni-project/uyuni/wiki/Contributing#uyuni-projectuyuni-repository

If you don't need a changelog check, please mark this checkbox:

• No changelog needed

If you uncheck the checkbox after the PR is created, you will need to re-run changelog_test (see below)

Re-run a test

If you need to re-run a test, please mark the related checkbox, it will be unchecked automatically once it has re-run:

• Re-run test "changelog_test"
• Re-run test "backend_unittests_pgsql"
• Re-run test "java_pgsql_tests"
• Re-run test "schema_migration_test_pgsql"
• Re-run test "susemanager_unittests"
• Re-run test "frontend_checks"
• Re-run test "spacecmd_unittests"

Before you merge

Check How to branch and merge properly!

[aaannz]

@rjmateus btw. I was discussing with @nadvornik if it would be feasible to completely remove pam_unix and pam_localuser and keep only pam_sss in account. Do you have any insight here?

[rjmateus]

@aaannz I think we added to allow authentication with machine local users. I think it would also allow users to log in to the machine using LDAP.
Since we moved to containers, I think it would make sense to only allow users from sssd. The local users would be the ones for postgres, tomcat and so on.