From 811e5fe03dc19c9e577aacb2044cd577457c61b7 Mon Sep 17 00:00:00 2001
From: Markus Hilger <markus.hilger@megware.com>
Date: Fri, 4 Sep 2026 19:22:11 +0200
Subject: [PATCH] Link the confluent pam service to wherever sshd's config
 lives

Linux-PAM reads vendor defaults from /usr/lib/pam.d and distributions are
migrating there package by package: systemd and polkit already ship into
it on both EL and Debian, and on SUSE 16 openssh has followed. There the
old code left a dangling /etc/pam.d/confluent and every pam authentication
against it failed.

The deb postinst carries the same logic, so fix it in step. ln -sf rather
than ln -s because -e is false for a dangling link, so the old code retried
the symlink and failed with 'File exists' instead of repairing it.
---
 confluent_server/builddeb                   | 10 +++++++++-
 confluent_server/confluent_server.spec.tmpl | 10 +++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/confluent_server/builddeb b/confluent_server/builddeb
index 644c61ef..69d7ee01 100755
--- a/confluent_server/builddeb
+++ b/confluent_server/builddeb
@@ -67,8 +67,16 @@ if [ $NEEDCHOWN = 1 ]; then
 fi
 systemctl daemon-reload
 if systemctl is-active confluent > /dev/null || [ $NEEDSTART = 1 ]; then systemctl restart confluent > /dev/null 2>&1; fi
+# -e is false for a dangling link, so an existing bad one is replaced. Linux-PAM
+# reads vendor defaults from /usr/lib/pam.d and distributions are migrating there
+# package by package; openssh has already done so on SUSE 16.
 if [ ! -e /etc/pam.d/confluent ]; then
-    ln -s /etc/pam.d/sshd /etc/pam.d/confluent
+    for pamsrc in /etc/pam.d/sshd /usr/lib/pam.d/sshd; do
+        if [ -f $pamsrc ]; then
+            ln -sf $pamsrc /etc/pam.d/confluent
+            break
+        fi
+    done
 fi
 true
 EOF
diff --git a/confluent_server/confluent_server.spec.tmpl b/confluent_server/confluent_server.spec.tmpl
index d62cd7df..f11df042 100644
--- a/confluent_server/confluent_server.spec.tmpl
+++ b/confluent_server/confluent_server.spec.tmpl
@@ -81,8 +81,16 @@ if [ $NEEDCHOWN = 1 ]; then
 fi
 systemctl daemon-reload
 if systemctl is-active confluent > /dev/null || [ $NEEDSTART = 1 ]; then /usr/bin/systemctl restart confluent >& /dev/null; fi
+# -e is false for a dangling link, so an existing bad one is replaced. Linux-PAM
+# reads vendor defaults from /usr/lib/pam.d and distributions are migrating there
+# package by package; openssh has already done so on SUSE 16.
 if [ ! -e /etc/pam.d/confluent ]; then
-    ln -s /etc/pam.d/sshd /etc/pam.d/confluent
+    for pamsrc in /etc/pam.d/sshd /usr/lib/pam.d/sshd; do
+        if [ -f $pamsrc ]; then
+            ln -sf $pamsrc /etc/pam.d/confluent
+            break
+        fi
+    done
 fi
 true