LDAP-UX Client Services B.05.00 with Microsoft Windows Active Directory Server Administrator's Guide (obsolete beyond B.05.00)

Table 8 Field syntax in an access rule (continued)
<object><type><action>
No value is required.otherdeny, allow, required,
<pam_code>
<function_name>
Specifies the function name in <library_name> that is
called to evaluate certain policy settings of the login user.
Example:
status:ads:check_ads_policy
For more information about account and password
security policy enforcement, see Section 6.4.10
(page 108).
<library_name>
The valid value for this
field can be rhds or
ads.
status
The following describes three fields defined in an access rule in details:
<action> This field defines a user's final access permission if an access rule is evaluated to
be true. Valid entries can be allow, deny, required, and PAM return codes.
Allow, deny, and required are character strings and the value itself is not case
sensitive. In additional to the general return codes, allow and deny, LDAP-UX
Client Services B.04.10 or later PAM_AUTHZ supports the meaningful PAM return
codes to the application which called the PAM API. PAM_AUTHZ does not evaluate
an access rule if no option is defined or if the action field contains an invalid
string.
<action> field can be one of following values:
allow
This option indicates that a user is granted the login authorization.
deny
This option indicates that a user is denied the login authorization.
required
This option indicates that a user is denied the login authorization if the rule evaluates
to false, or that processing should continue to the next rule if the rule evaluates to
true.
<pam_code>
One of the following meaningful PAM return codes can be specified in the <action>
field, the PAM return codes are character strings:
• PAM_SUCCESS
• PAM_PERM_DENIED
• PAM_MAXTRIES
• PAM_AUTH_ERR
• PAM_NEW_AUTHTOK_REQD
• PAM_AUTHTOKEN_REQD
• PAM_CRED_INSUFFICIENT
• PAM_AUTHINFO_UNAVAIL
• PAM_USER_UNKNOWN
• PAM_ACCT_EXPIRED
• PAM_AUTHTOK_EXPIRED
104 Administering LDAP-UX Client Services