HP-UX Reference (11i v3 07/02) - 3 Library Functions N-Z (vol 7)

ManualsBrandsHP ManualsSoftwareHP-UX Reference Manuals

100

pam_chauthtok(3) pam_chauthtok(3)

NAME

pam_chauthtok - perform password related functions within the PAM framework

SYNOPSIS

cc [ ﬂag ... ] ﬁle ...

-lpam [ library ... ]

#include <security/pam_appl.h>

int pam_chauthtok(pam_handle_t *

pamh, int ﬂags);

DESCRIPTION

pam_chauthtok()

is called to change the authentication token associated with a particular user refer-

enced by the authentication handle, pamh.

The following ﬂag may be passed in to

pam_chauthtok():

PAM_SILENT

The password service should not generate any messages.

PAM_CHANGE_EXPIRED_AUTHTOK

The password service should only update those passwords that have aged. If this ﬂag is not passed,

all password services should update their passwords.

Upon successful completion of the call, the authentication token of the user will be changed in accordance

with the password service conﬁgured in the system through pam.conf(4).

Notes

The ﬂag PAM_CHANGE_EXPIRED_AUTHTOK

is typically used by a login application which has deter-

mined that the user’s password has aged or expired. Before allowing the user to login, the

tion may invoke

pam_chauthtok()

with this ﬂag to allow the user to update the password. Typically

applications such as passwd(1) should not use this ﬂag.

pam_chauthtok() performs a preliminary check before attempting to update passwords. This check is

performed for each password module in the stack as listed in pam.conf(4). The check may include pinging

remote name services to determine if they are available. If

pam_chauthtok()

returns

PAM_TRY_AGAIN, then the check has failed, and passwords are not updated.

APPLICATION USAGE

Refer to pam(3) for information on thread-safety of PAM interfaces.

RETURN VALUE

Upon successful completion,

PAM_SUCCESS is returned. In addition to the error return values described

in pam(3), the following values may be returned:

PAM_PERM_DENIED No permission.

PAM_AUTHTOK_ERR Authentication token manipulation error.

PAM_AUTHTOK_RECOVERY_ERR

Authentication information cannot be recovered.

PAM_AUTHTOK_LOCK_BUSY

Authentication token lock busy.

PAM_AUTHTOK_DISABLE_AGING Authentication token aging disabled.

PAM_USER_UNKNOWN User unknown to password service.

PAM_TRY_AGAIN Preliminary check by password service failed.