Handle missing IdP trait in PAM interpolation.

[xacrimon]

This defaults the environment variable during PAM environment variable interpolation if it does not exist. The fallback value is meant to indicate a misconfiguration to notify admins of the issue.

Needs backport to branch/v6.

Fixes #6545

[russjones]

@xacrimon I'm not sure setting a placeholder is the right answer here, what are our alternatives?

[xacrimon]

@xacrimon I'm not sure setting a placeholder is the right answer here, what are our alternatives?

There's three courses of action that are possible to take here

• A) Bubble up the error which causes the SSH connection to fail. This should be included in error logs. This is the current behaviour.
• B) Set a placeholder and log a warning. This is my proposed solution.
• C) Don't define the variable at all in the PAM environment. My issue with this is it requires handling the potential nonexistance of these environment values within the PAM module which I feel is inconsistent and cumbersome. Not setting the environment value prevents you from distinguishing between a config that doesn't specify this value due to a node misconfiguration and a misconfigured IdP. I'd rather guarantee their existence to remove this ambiguity.

Option A is problematic because it kills all ability to connect to the node with the misconfigured IdP and due to this figuring out the error can be cumbersome as you need to access the node another way in order to find out what is going wrong.

[russjones]

@fspmarshall @r0mant Can you review?