[Feature Request] Compliance Setting: "OS must map the authenticated identity to the user or group account for PKI-based authentication"

Is your feature request related to a problem? Please describe.

STIG scans calling out RHEL-09-631015/OL09-00-000910/ALMA-09-038960

Describe the solution you'd like

Per the STIG guidance:

Configure the OS to map the authenticated identity to the user or group account by adding or modifying the certmap section of the "/etc/sssd /sssd.conf" file or a "*.conf" file within the "/etc/sssd/conf.d/" directory, based on the following example:

[certmap/testing.test/rule_name]
matchrule = .*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = testing.test

The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command:

$ systemctl restart sssd.service

Describe alternatives you've considered

Additional context

Start by locating the Salt formula entry points that manage SSSD configuration and service restarts. Compare the STIG example for the certmap section in /etc/sssd/sssd.conf or /etc/sssd/conf.d/*.conf, then verify that the sssd service is restarted and the requested identity mapping is applied.