HP-UX Reference (11i v2 03/08) - 3 Library Functions N-Z (vol 7)

ManualsBrandsHP ManualsSoftwareHP-UX Reference Manuals

111

112

113

114

115

116

117

118

119

120

pam_chauthtok(3) pam_chauthtok(3)

NAME

pam_chauthtok - perform password related functions within the PAM framework

SYNOPSIS

cc [ ﬂag ... ] ﬁle ...

-lpam [ library ... ]

#include <security/pam_appl.h>

int pam_chauthtok(pam_handle_t *

pamh, int ﬂags, int argc,

const char **argv);

DESCRIPTION

pam_chauthtok()

is called to change the authentication token associated with a particular user refer-

enced by the authentication handle, pamh.

The following ﬂag may be passed in to

pam_chauthtok()

PAM_SILENT

The password service should not generate any messages.

PAM_CHANGE_EXPIRED_AUTHTOK

The password service should only update those passwords that have aged. If this ﬂag is not passed,

all password services should update their passwords.

Upon successful completion of the call, the authentication token of the user will be changed in accordance

with the password service conﬁgured in the system through pam.conf(4).

APPLICATION USAGE

Refer to pam(3) for information on thread-safety of PAM interfaces.

NOTES

The ﬂag

PAM_CHANGE_EXPIRED_AUTHTOK

is typically used by a login application which has deter-

mined that the user’s password has aged or expired. Before allowing the user to login, the

cation may invoke

pam_chauthtok()

with this ﬂag to allow the user to update the password. Typi-

cally applications such as passwd(1) should not use this ﬂag.

pam_chauthtok() performs a preliminary check before attempting to update passwords. This check is

performed for each password module in the stack as listed in pam.conf (4). The check may include ping-

ing remote name services to determine if they are available. If pam_chauthtok()

returns

PAM_TRY_AGAIN, then the check has failed, and passwords are not updated.

RETURN VALUES

Upon successful completion,

PAM_SUCCESS is returned. In addition to the error return values described

in pam(3), the following values may be returned:

PAM_PERM_DENIED No permission.

PAM_AUTHTOK_ERR Authentication token manipulation error.

PAM_AUTHTOK_RECOVERY_ERR Authentication information cannot be recovered.

PAM_AUTHTOK_LOCK_BUSY Authentication token lock busy.

PAM_AUTHTOK_DISABLE_AGING Authentication token aging disabled.

PAM_USER_UNKNOWN User unknown to password service.

PAM_TRY_AGAIN Preliminary check by password service failed.