diff -up authconfig-7.0.1/authinfo.py.nss-update authconfig-7.0.1/authinfo.py

--- authconfig-7.0.1/authinfo.py.nss-update	2017-05-16 14:55:45.294736031 +0200

+++ authconfig-7.0.1/authinfo.py	2017-07-20 11:34:11.332143359 +0200

@@ -93,9 +93,7 @@ PATH_SEBOOL = "/usr/sbin/setsebool"

 PATH_SCEVENTD = "/usr/bin/pkcs11_eventmgr"

 PATH_SCSETUP = "/usr/bin/pkcs11_setup"

-PATH_LIBNSS_LDAP = "/usr" + LIBDIR + "/libnss_ldap.so.2"

-if not os.path.isfile(PATH_LIBNSS_LDAP):

-	PATH_LIBNSS_LDAP = LIBDIR + "/libnss_ldap.so.2"

+PATH_LIBNSS_LDAP = LIBDIR + "/libnss_ldap.so.2"

 PATH_LIBNSS_NIS = LIBDIR + "/libnss_nis.so.2"

 PATH_LIBNSS_WINBIND = LIBDIR + "/libnss_winbind.so.2"

 PATH_LIBNSS_SSS = LIBDIR + "/libnss_sss.so.2"

@@ -107,7 +105,7 @@ PATH_PAM_PKCS11 = AUTH_MODULE_DIR + "/pa

 PATH_PAM_FPRINTD = AUTH_MODULE_DIR + "/pam_fprintd.so"

 PATH_PAM_SSS = AUTH_MODULE_DIR + "/pam_sss.so"

-PATH_LIBSSS_AUTOFS = "/usr" + LIBDIR + "/sssd/modules/libsss_autofs.so"

+PATH_LIBSSS_AUTOFS = LIBDIR + "/sssd/modules/libsss_autofs.so"

 PATH_WINBIND_NET = "/usr/bin/net"

@@ -213,10 +211,10 @@ def checkNSS(configuration, candidate):

 		start = configuration.find(candidate, start)

 		if start < 0:

 			return None

-		if start > 0 and configuration[start-1].isalnum():

+		if start > 0 and not configuration[start-1].isspace():

 			start += clen

 			continue

-		if start+clen < len(configuration) and configuration[start+clen].isalnum():

+		if start+clen < len(configuration) and not configuration[start+clen].isspace():

 			start += clen

 			continue

 		return start

@@ -1293,10 +1291,12 @@ class AuthInfo:

 		self.enableMDNS = None

 		self.enableMyhostname = None

 		self.preferDNSinHosts = None

+		self.preferSSSinNsswitch = True

 		self.enableSSSD = None

-                # This one we don't have a config entry, we just

+                # For these we don't have a config entry, we just

                 # preserve the entry if we see it.

 		self.enableAltfiles = None

+		self.enableSystemd = None

 		# Authentication setup.

 		self.enableNullOk = True

@@ -1394,8 +1394,9 @@ class AuthInfo:

 		("winbindSeparator", "c"), ("winbindTemplateHomedir", "c"), ("winbindTemplateShell", "c"),

 		("winbindUseDefaultDomain", "b"), ("winbindOffline", "b"), ("winbindKrb5", "b")]),

 	SaveGroup(self.writeNSS, None, [("enableWinbind", "b"), ("enableNIS", "b"), ("enableNIS3", "b"),

-		("enableLDAP", "b"), ("enableMDNS", "b"), ("enableMyhostname", "b"),

-		("enableSSSD", "b"), ("preferDNSinHosts", "b"), ("implicitSSSD", "b")]),

+		("enableLDAP", "b"), ("enableMDNS", "b"), ("enableMyhostname", "b"), ("enableSystemd", "b"),

+		("enableAltfiles", "b"), ("enableSSSD", "b"), ("preferDNSinHosts", "b"), ("implicitSSSD", "b"),

+		("preferSSSinNsswitch", "b")]),

 	SaveGroup(self.writePAM, None, [("pwqualityArgs", "c"), ("passwdqcArgs", "c"),

 		("faillockArgs", "c"), ("enableFaillock", "b"),

 		("localuserArgs", "c"), ("pamAccessArgs", "c"), ("enablePAMAccess", "b"),

@@ -1984,9 +1985,9 @@ class AuthInfo:

 				# some modules can be found in hosts only

 				value = matchKey(line, "hosts:")

 				if value:

-					if checkNSS(value, "mdns4_minimal [NOTFOUND=return]"):

+					if checkNSS(value, "mdns4_minimal [NOTFOUND=return]") != None:

 						self.setParam("enableMDNS", True, ref)

-					if checkNSS(value, "myhostname"):

+					if checkNSS(value, "myhostname") != None:

 						self.setParam("enableMyhostname", True, ref)

 					nispos = checkNSS(value, "nis")

@@ -1996,12 +1997,14 @@ class AuthInfo:

 		if nssconfig:

 			nssmap = (('LDAP', 'ldap'), ('NIS', 'nis'), ('Altfiles', 'altfiles'),

-				('NIS3', 'nisplus'), ('Winbind', 'winbind'))

+				('NIS3', 'nisplus'), ('Winbind', 'winbind'), ('Systemd', 'systemd'))

 			for attr, nssentry in nssmap:

-				if checkNSS(nssconfig, nssentry):

+				if checkNSS(nssconfig, nssentry) != None:

 					self.setParam('enable' + attr, True, ref)

-

-			self.setParam("implicitSSSD", bool(checkNSS(nssconfig, "sss")), ref)

+			ssspos = checkNSS(nssconfig, "sss")

+			self.setParam("implicitSSSD", ssspos != None, ref)

+			if ssspos != None:

+				self.setParam("preferSSSinNsswitch", ssspos == 0, ref)

 		f.close()

 		return True

@@ -3504,8 +3507,12 @@ class AuthInfo:

 			if self.enableNIS:

 				normal += " nis"

 			if self.enableSSSD or self.implicitSSSD:

-				normal += " sss"

-				services += " sss"

+				if self.preferSSSinNsswitch:

+					normal = "sss " + normal

+					services = "sss " + services

+				else:

+					normal += " sss"

+					services += " sss"

 			if self.enableLDAP and not self.implicitSSSD:

 				normal += " ldap"

@@ -3516,6 +3523,9 @@ class AuthInfo:

 			users = normal

 			if self.enableWinbind:

 				users += " winbind"

+			shadow = normal

+			if self.enableSystemd:

+				users += " systemd"

 			# Adjust automount from normal.

 			automount = normal

@@ -3558,7 +3568,7 @@ class AuthInfo:

 				elif matchLine(ls, "shadow:"):

 					if not wroteshadow:

 						output += "shadow:    "

-						output += users

+						output += shadow

 						output += "\n"

 						wroteshadow = True

 				# If it's a 'group' line, insert ours instead.

@@ -3613,7 +3623,7 @@ class AuthInfo:

 				output += "\n"

 			if not wroteshadow:

 				output += "shadow:    "

-				output += users

+				output += shadow

 				output += "\n"

 			if not wrotegroup:

 				output += "group:     "