LDAP-UX Client Services B.04.10 Administrator's Guide (edition 7)

Constructing an Access Rule in pam_authz.policy
In the policy file, /etc/opt/ldapux/pam_authz.policy, an access rule consists of three
fields as follows:
<action>:<type>:<object>
All fields are mandatory except for the <object> field when unix_local_user or Other is
specified in the <type> field. If any field is missing or contains the incorrect syntax, the access
rule is considered to be invalid and is ignored by PAM_AUTHZ.
These fields have the following limitations:
• No leading or trailing empty space is allowed in a field
• Fields are separated by a separator, :
• No leading or trailing empty space is allowed in a separator
• An access rule is terminated by a carriage return
Fields in an Access Rule
Table 5-1 shows a summary on all possible values and syntax of an access rule:
Table 5-1 Field Syntax in an Access Rule
<object><type><action>
A list of user name. It can be the multi-valued field. Each
value is a character string that is separated by a separator
"," (ASCII 2C HEX).
Example:
user1, user2, user3
unix_userdeny, allow, <pam_code>
No value is required.
unix_local_userdeny, allow, <pam_code>
A list of group name. It can be the multi-valued field.
Each value is a character string that is separated by a
separator "," (ASCII 2C HEX).
Example:
group1, group2, group3
unix_groupdeny, allow, <pam_code>
A list of netgroup name. It can be the multi-valued field.
Each value is a character string that is separated by a
separator ","(ASCII 2C HEX).
Example:
netgroup1, netgroup2, netgroup3
netgroupdeny, allow, <pam_code>
It is the Distinguished name of a ldap group with
groupofnames objectclass or groupofuniquenames
objectclass. It is a single-valued field. No separator is
required. The syntax of DN is defined in RFC2253.
Example:
cn=ldapgroup1,cn=groups,dc=mydomain,dc=com
ldap_groupdeny, allow, <pam_code>
It is a single search descriptor that specifies one or more
(attribute=value) or (attribute=$[variable_name]) pairs.
$[variable_name] is a dynamic variable. It is a single
value field. Only one search filter is allowed. No
separator is required. The syntax of DN is defined in
RFC2254.
Example:
(&(manager=Joeh)(department=sales)(hostcontrol=$[HOSTNAME]))
ldap_filterdeny, allow, <pam_code>
PAM_AUTHZ Login Authorization 103