LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide

Table 7-1 Field Syntax in an Access Rule (continued)
<object><type><action>
No value is required.
otherdeny, allow, <pam_code>
<function_name>
Specifies the function name in <library_name> that
is called to evaluate certain policy settings of the login
user.
Example:
status:ads:check_ads_polcy
See the “Account and Password Security Policy
Enforcement “ section for details.
<library_name>
The valid value for
this field can be rhds
or ads.
status
The following describes three fields defined in an access rule in details:
<action> This field defines a user's final access permission if an access rule is evaluated to
be true. Valid entries can be allow, deny and PAM return codes. Allow and deny
are character strings and the value itself is not case sensitive. In additional to the
general return codes, allow and deny, LDAP-UX Client Services B.04.10 or later,
PAM_AUTHZ supports the meaningful PAM return codes to the application which
called the PAM API. PAM_AUTHZ does not evaluate an access rule if no option
is defined or if the action field contains an invalid string.
<action> field can be one of following values:
allow
This option indicates that a user is granted the login authorization.
deny
This option indicates that a user is denied the login authorization.
<pam_code>
One of the following meaningful PAM return codes can be specified in the
<action> field, the PAM return codes are character strings:
• PAM_SUCCESS
• PAM_PERM_DENIED
• PAM_MAXTRIES
• PAM_AUTH_ERR
• PAM_NEW_AUTHTOK_REQD
• PAM_AUTHTOKEN_REQD
• PAM_CRED_INSUFFICIENT
• PAM_AUTHINFO_UNAVAIL
• PAM_USER_UNKNOWN
• PAM_ACCT_EXPIRED
• PAM_AUTHTOK_EXPIRED
For example, if the PAM_AUTHZ policy rule indicates that an account has been
locked out or a password has expired, PAM_AUTHZ can return an appropriate
PAM error code instead of a general deny error code.
<type> The value in this field represents the type of access rule. It defines what kinds of
user information that PAM_AUTHZ needs to look for. The value also helps to
determine the correct syntax in the following <object> field.
The following describes the valid values for this field:
unix_user, unix_local_user, unix_group, netgroup, ldap_group
112 Administering LDAP-UX Client Services