pam_dce(5)

NAME
pam_dce - authentication, account, and password management PAM functions for DCE

SYNOPSIS

/usr/lib/security/pam_dce.so.1

DESCRIPTION

The DCE PAM module allows for integration of DCE into the system entry services (such as login) through the pam.conf(4) file. The DCE service module for PAM consists of three components: authentication, account management, and password management. All three components are supported through the same loadable library, /usr/lib/security/pam_dce.so.1.

DCE Authentication Module
The DCE authentication component provides functions to verify the identity of a user (pam_sm_authenticate(3)), and to initialize DCE credentials (pam_sm_setcred(3)). The DCE implementation of the pam_sm_authenticate(3) function compares the user entered password with the password from the DCE Security Service (i.e., the DCE Registry). If the passwords match, the user is authenticated and obtains DCE credentials. The following options may be passed to the DCE Authentication module:

    debug
        Syslog debugging information at the LOG_DEBUG level.

    nowarn
        Turns off warning messages about not being able to acquire DCE credentials.

    use_first_pass
        Use the user's initial password (entered when the user is authenticated to the first authentication module in the stack) to authenticate with DCE. If the passwords do not match, or if this is the first authentication module in the stack, quit and do not prompt the user for a password. It is recommended that this option only be used if the DCE authentication module is designated as optional in the pam.conf configuration file.

    try_first_pass
        Use the user's initial password (entered when the user is authenticated to the first authentication module in the PAM stack) to authenticate with DCE. If the passwords do not match, or if this is the first authentication module in the stack, prompt the user for a password.

    use_mapped_pass
        This option will attempt to retrieve the "onc_dce_passwd" attribute from the user's XFN context and use the user's initial password to decrypt the DCE password stored in this attribute. If the DCE password stored in this attribute is incorrect, then quit and do not prompt the user for a password. It is recommended that this option only be used if the DCE authentication module is designated as optional.

    try_mapped_pass
        Similar to use_mapped_pass with two exceptions. If the DCE password is incorrect, prompt for it. Once a valid DCE password is entered, encrypt it using the initial (first) password and store the encrypted value in the "onc_dce_passwd" attribute in the user's XFN context.

    Note that both use_mapped_pass and try_mapped_pass require that the UNIX authentication module (see pam_unix(5)) occurs before the DCE authentication module. This to ensure that the user's secure RPC credentials (for XFN/NIS+) have already been acquired.
If the user's DCE account has expired then an error will be returned from pam_sm_authenticate(3).

In order to authenticate the user to the DCE security service pam_sm_authenticate(3) calls sec_login_setup_identity(3) followed by sec_login_valid_and_cert_ident(3).

pam_sm_setcred(3) calls the function sec_login_set_context(3) to set the DCE credentials after they have been validated by pam_sm_authenticate.

DCE Account Management Module
The DCE account management component provides a function to perform account management (pam_sm_acct_mgmt(3)). The DCE implementation of the pam_sm_acct_mgmt(3) function retrieves the user's account and password expiration information from the DCE Security Server and verifies that the user's account and password have not expired. The following options may be passed to the DCE account module:

    allow_expired_passwd
        Allows a user with an expired password to login.

    debug
        Syslog debugging information at the LOG_DEBUG level.

    nowarn
        Turns off the warning messages displayed when a user's account and/or password are going to expire.

pam_sm_acct_mgmt(3) calls the function sec_login_inquire_net_info(3) to retrieve information about when a user's account and/or password is going to expire.

DCE Password Management Module
The DCE password management component provides a function to change passwords (pam_sm_chauthtok(3)). The following option may be passwd to the DCE account module:

    debug
        Syslog debugging information at the LOG_DEBUG level.

SEE ALSO
pam(3), sec_login_setup_identity(3), sec_login_valid_and_cert_ident(3), sec_login_set_context(3), sec_login_inquire_net_info(3), pam.conf(4), pam_unix(5)