Synopsis

LONG PamAcctMgmt(
         struct PamHandle * handle,
         ULONG flags );

Function

Run the "account" stack: may this user use this service now, from
here. Call after PamAuthenticate().

Synopsis

LONG PamAuthenticate(
         struct PamHandle * handle,
         ULONG flags );

Function

Run the service's "auth" stack: establish that the user is who they
claim to be. The modules obtain the user name and the password
through the conversation unless both are already set.

Inputs

flags - PAM_SILENT, PAM_DISALLOW_NULL_AUTHTOK.

Result

PAM_SUCCESS or a failure code; PAM_AUTH_ERR for a wrong password or
unknown user, PAM_MAXTRIES when locked out.

Notes

Nothing about the calling task changes; see PamSetCred().

Synopsis

LONG PamChAuthTok(
         struct PamHandle * handle,
         ULONG flags );

Function

Change the user's password: the "password" stack is run twice, with
PAM_PRELIM_CHECK (may it be changed, is the old one right) and then
with PAM_UPDATE_AUTHTOK, which replays the modules of the first
pass. Applications may not pass either flag themselves. A token
that was used to authenticate on the same handle is taken as the
old password; the new one is asked for twice when the
conversation is interactive.

Synopsis

LONG PamCloseSession(
         struct PamHandle * handle,
         ULONG flags );

Function

Run the "session" stack's close functions.

Synopsis

LONG PamConverse(
         struct PamHandle * handle,
         LONG nmsg,
         const struct pam_message ** msgs,
         struct pam_response ** resp );

Function

Module side: put messages and questions to the person through the
transaction's conversation. On PAM_SUCCESS *resp is an array of
nmsg responses; free it with FreeVec() after wiping, or let
PamGetAuthTok()/PamGetUser() do the work for the usual cases.

Synopsis

LONG PamEnd(
         struct PamHandle * handle,
         LONG status );

Function

Finish a transaction. Module data is released (with its cleanup
functions, which receive status) and the tokens are wiped.

Result

PAM_SUCCESS.

Synopsis

LONG PamFailDelay(
         struct PamHandle * handle,
         ULONG usec );

Function

Ask for a delay before PamAuthenticate() returns a failure. The
largest request wins. The delay is applied only to interactive
transactions; a network service gets its refusal at once.

Synopsis

LONG PamGetAuthTok(
         struct PamHandle * handle,
         ULONG item,
         CONST_STRPTR * tok,
         CONST_STRPTR prompt );

Function

Module side: the token (PAM_AUTHTOK or PAM_OLDAUTHTOK), asking for
it unechoed through the conversation if it is not set yet. In the
update pass of PamChAuthTok() a new PAM_AUTHTOK is asked for twice
and PAM_AUTHTOK_ERR returned if the two differ.

Synopsis

LONG PamGetData(
         struct PamHandle * handle,
         CONST_STRPTR name,
         APTR * data );

Function

Module side: retrieve data stored with PamSetData().

Result

PAM_SUCCESS or PAM_NO_MODULE_DATA.

Synopsis

LONG PamGetItem(
         struct PamHandle * handle,
         ULONG item,
         APTR * value );

Function

Read an item. The pointer returned belongs to the transaction.

Result

PAM_SUCCESS, PAM_BAD_ITEM.

Synopsis

LONG PamGetUser(
         struct PamHandle * handle,
         CONST_STRPTR * user,
         CONST_STRPTR prompt );

Function

Module side: the user name, asking through the conversation if it
is not set yet (prompt, else PAM_USER_PROMPT, else "login: ").

Synopsis

void PamLog(
         struct PamHandle * handle,
         LONG level,
         CONST_STRPTR text );

Function

Module side: record a message. It is posted to log.resource
(provider "pam.library", the service as sub-component) together
with the user, when the resource is present, and to the debug
output.

Inputs

level - PAM_LOG_ERROR, PAM_LOG_WARNING, PAM_LOG_INFO, PAM_LOG_DEBUG.
text  - the message; control characters are replaced.

Synopsis

LONG PamOpenSession(
         struct PamHandle * handle,
         ULONG flags );

Function

Run the "session" stack's open functions (records, variables,
assigns, profile).

Synopsis

LONG PamSetCred(
         struct PamHandle * handle,
         LONG flags );

Function

Establish (PAM_ESTABLISH_CRED) or drop (PAM_DELETE_CRED) the
credentials of the authenticated user on the task of PAM_AROS_TASK.
With security.library this changes the task's owner. Call after a
successful PamAuthenticate().

Synopsis

LONG PamSetData(
         struct PamHandle * handle,
         CONST_STRPTR name,
         APTR data,
         PamDataCleanup cleanup );

Function

Module side: attach private data to the transaction under a name.
Replacing data calls the old cleanup with PAM_SUCCESS; PamEnd()
calls it with the final status.

Synopsis

LONG PamSetItem(
         struct PamHandle * handle,
         ULONG item,
         APTR value );

Function

Set an item of the transaction. String items are copied.

Result

PAM_SUCCESS, PAM_BAD_ITEM, PAM_BUF_ERR.

Synopsis

struct PamHandle * PamStartA(
         CONST_STRPTR service,
         CONST_STRPTR user,
         struct Hook * conv,
         struct TagItem * tags );

struct PamHandle * PamStart(
         CONST_STRPTR service,
         CONST_STRPTR user,
         struct Hook * conv,
         TAG tag, ... );

Function

Begin an authentication transaction for a service. The service name
selects the file SYS:Security/PAM/<service> that lists the modules
to run; without one, "other" is used, and without that a built-in
default that depends on whether security.library is present and
configured.

Inputs

service - name of the service ("login", "envoy", "sshd", ...).
user    - the user name, or NULL to let the modules ask.
conv    - conversation hook, or NULL for one of the library's own
          (see <libraries/pam.h>).
tags    - PAMT_#? tags.

Result

The handle, or NULL.

See also

PamEnd() PamAuthenticate() PamSetItem()

Synopsis

CONST_STRPTR PamStrError(
         struct PamHandle * handle,
         LONG code );

Function

Text for a result code. handle may be NULL.