NAME
pam_sm_acct_mgmt() — service provider implementation for pam_acct_mgmt
SYNOPSIS
cc
[flag]... file...
-lpam
[library]...
#include <security/pam_appl.h>
#include <security/pam_modules.h>
int pam_sm_acct_mgmt(pam_handle_t *pamh,
int flags,
int argc,
const char **argv);
DESCRIPTION
In response to a call to
pam_acct_mgmt(3),
the PAM framework calls
pam_sm_acct_mgmt()
from the modules listed in the
pam.conf(4)
file.
The account management provider supplies the back-end functionality for
this interface function.
The applications should not call this API directly.
The function,
pam_sm_acct_mgmt(),
determines whether the current user's account and password are valid.
This includes checking for password
and account expiration, valid log-in times, etc.
The user in question is specified by a prior call to
pam_start(),
and is referenced by the authentication handle,
pamh,
which is passed as the first argument to
pam_sm_acct_mgmt().
The following flags may be set in the
flags
field:
- PAM_SILENT
The account management service should not generate any messages.
- PAM_DISALLOW_NULL_AUTHTOK
The account management service should return
PAM_AUTHTOKEN_REQD
if the user has a null authentication token.
The
argc
argument
represents the number of module options passed in from the configuration file
pam.conf(4).
argv
specifies the module options, which are interpreted and processed
by the account management service. Please refer to the specific
module man pages for the various available
options.
If an unknown option is passed to the module, an error should be
logged through
syslog(3C)
and the option ignored.
If an account management module determines that the user
password has aged or expired, it should save this information
as state in the authentication handle,
pamh,
using
pam_set_data().
pam_chauthtok()
uses this information to determine which passwords have
expired.
APPLICATION USAGE
Refer to
pam(3)
for information on thread-safety of PAM interfaces.
RETURN VALUE
If there are no restrictions to logging in,
PAM_SUCCESS
is returned.
The following error values may also be returned upon error:
- PAM_USER_UNKNOWN
User not known to underlying authentication module.
- PAM_AUTHTOKEN_REQD
New authentication token required.
- PAM_ACCT_EXPIRED
User account has expired.
- PAM_PERM_DENIED
User denied access to account at this time.
- PAM_IGNORE
Ignore underlying account module regardless of whether the control
flag is
required,
optional
or
sufficient
- PAM_ACCT_DISABLED
User account has been disabled (trusted mode only).
- PAM_TERM_DISABLED
Terminal has been disabled (trusted mode only).
- PAM_NOT_AUTHORIZED
User is not authorized for terminal access (trusted mode only).
- PAM_NOT_RTIME
Wrong time to login (trusted mode only).
WARNINGS
HP-UX 11i Version 3 is the last release to support
trusted systems functionality.
Printable version
