LDAP-UX Client Services B.04.10 Administrator's Guide (edition 7)

Policy Validator
PAM_AUTHZ works as a policy validator. Once it receives a PAM request, it starts to process
the access rules defined in pam_authz.policy. It validates and determines the user's login
authorization based on the user's login name and the information it retrieves from various name
services. The result is then returned to the PAM framework.
PAM_AUTHZ processes access rules in the order they are defined in the pam_authz.policy.
It stops processing the access rules when any one of the access rules is evaluated to be true
(match). That rule is called the "authorative" rule. If any access rule is evaluated to be false (no
match), the rule is skipped. If all access rules in the policy file have been evaluated but the user's
access right can not be determined, the user is restricted from login.
NOTE:
• If the user's login name is root or UID is 0, PAM_AUTHZ does not process the access rules
defined in pam_authz.policy. The root user is always granted login access.
• The default <action> of PAM_AUTHZ is "deny" if no authorative rule is found.
The following describes situations where PAM_AUTHZ skips an access rule and does not process
it:
• An access rule contains the wrong syntax.
• PAM_AUTHZ processes the ldap_filter and ldap_group types of access rules by
querying the LDAP directory server through ldapclientd daemon. If LDAP-UX Client
Services is not running, PAM_AUTHZ skips all the ldap_filter and ldap_group types
of rules.
An Example of Access Rule Evaluation
The following shows an example of the /etc/opt/ldapux/pam_authz.policy file:
allow:unix_user:user1,user2,user3,user4
allow:unix_group:group1,group2
deny:unix_group:group11,group12
allow:netgroup:netgroup1,netgroup2
allow::ldap_group:ldapgroup1,ldapgroup2
allow:ldap_filter:(&(manager=Joeh) (department=marketing)(hostname=$[HOSTNAME]))
PAM_AUTHZ processes access rules in the order they are defined in the pam_authz.policy
file. It stops evaluating the access rules when any one of the access rule is matched. In the above
example, if the user2 user attempts to login, it matches one of the user names in the first access
rule, PAM_AUTHZ stops evaluating the rest of the access rules and allows the user2 user to
login. For another example, user5 attempts to login and this user is only a member of
ldapgroup2. PAM_AUTHZ validates user5's login access and when the fifth access rule is
evaluated to be true, user5 is granted the login access.
If the user6 user reports to Joeh, the user's job is related to marketing and has a hostname
attribute with the returned value, HostSrv, in his/her user entry in the LDAP directory.
PAM_AUTHZ starts to validate user6's login access by evaluating all the access rule defined in
pam_authz.policy. The sixth access rule is evaluated to be true, the user6 is allowed to log
in to the host, HostSrv.
Dynamic Variable Support
Dynamic variable support is a method by which an access rule can be defined where part or all
of the policy criteria will be determined at the time the rule is evaluated. For example, the name
of the computer from which the user attempts to logon can be substituted into the access rule to
be evaluated. See the “Dynamic Variable Access Rule ” (page 108) section for more information
on how to define an access rule using dynamic variable support.
102 Administering LDAP-UX Client Services