Remove SYSDB_PASSKEY_USER_VERIFICATION and related functions. In
phase 1 of passkey implementation we read passkey user verification
from IPA LDAP tree, however now user verification is sent to the
SSSD krb5 plugin from ipa-otpd.

Reviewed-by: Iker Pedrosa <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
(cherry picked from commit 879d073)

Local auth functions should only be reached in AD/LDAP auth flows.

Reviewed-by: Iker Pedrosa <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
(cherry picked from commit 304f298)

Remove support of ambiguous "unset" state of passkey user verification.
pam_sss prompting is binary, either on or off. The use of 'unset' passkey
user verification state allows for ambiguous behavior in SSSD. For
example, passkey_child may perform undefined behavior when '--user-verification'
argument is not set, now SSSD will always send '--user-verification=false/true'
to passkey_child.

Reviewed-by: Iker Pedrosa <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
(cherry picked from commit e9216fc)

When authenticating with a passkey, different PAM code paths within SSSD
can result in the `authtok` containing data even when the user did not
enter a PIN. Depending on the flow (e.g., triggered by `gdm` vs. `su`),
this data might be an empty string or non-printable characters like `^L`
(form feed).

The previous code had two issues:
1.  It only checked if the `authtok` was non-empty
    (`sss_authtok_get_type(...) != SSS_AUTHTOK_TYPE_EMPTY`). If user
    verification was disabled, this check would incorrectly pass for
    these 'junk' `authtok` values. This caused SSSD to prepare and send
    an erroneous PIN to the passkey helper.

2.  In the case where the `authtok` *was* correctly empty, the check
    would fail, `write_buf_len` would remain 0, and the `if
    (write_buf_len != 0)` block containing the `write_pipe_send` call
    would be skipped. This stalled the authentication flow, as the
    callback to continue the process was never set.

This patch fixes both issues:
1.  The `user_verification` setting is now stored in the state struct.
    The logic is updated to only prepare the PIN buffer if the `authtok`
    is non-empty *and* user verification is required
    (`state->user_verification != PAM_PASSKEY_VERIFICATION_OFF`).

2.  The `write_pipe_send` call is moved outside the conditional block so
    it always runs. This ensures that the asynchronous child
    communication (via `passkey_child_write_done`) is always triggered,
    even if the write buffer is empty (0-length).

This resolves both failure modes: junk PINs are no longer sent when
verification is off, and the auth flow no longer stalls when no PIN is
present.

Signed-off-by: Iker Pedrosa <[email protected]>
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit bc1460c)
Reviewed-by: Iker Pedrosa <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>