pam_chauthtok(3)                                           pam_chauthtok(3)




 NAME    [Toc]    [Back]
      pam_chauthtok - perform password related functions within the PAM
      framework

 SYNOPSIS    [Toc]    [Back]
      cc [ flag ... ] file ...  -lpam [ library ... ]

      #include <security/pam_appl.h>

      int pam_chauthtok(pam_handle_t *pamh, int flags, int argc,
           const char **argv);

 DESCRIPTION    [Toc]    [Back]
      pam_chauthtok() is called to change the authentication token
      associated with a particular user referenced by the authentication
      handle, pamh.

      The following flag may be passed in to pam_chauthtok():

      PAM_SILENT    [Toc]    [Back]
           The password service should not generate any messages.

      PAM_CHANGE_EXPIRED_AUTHTOK    [Toc]    [Back]
           The password service should only update those passwords that have
           aged.  If this flag is not passed, all password services should
           update their passwords.

      Upon successful completion of the call, the authentication token of
      the user will be changed in accordance with the password service
      configured in the system through pam.conf(4).

 APPLICATION USAGE    [Toc]    [Back]
      Refer to pam(3) for information on thread-safety of PAM interfaces.

 NOTES    [Toc]    [Back]
      The flag PAM_CHANGE_EXPIRED_AUTHTOK is typically used by a login
      application which has determined that the user's password has aged or
      expired.  Before allowing the user to login, the login application may
      invoke pam_chauthtok() with this flag to allow the user to update the
      password.  Typically applications such as passwd(1) should not use
      this flag.

      pam_chauthtok() performs a preliminary check before attempting to
      update passwords. This check is performed for each password module in
      the stack as listed in pam.conf(4).  The check may include pinging
      remote name services to determine if they are available. If
      pam_chauthtok() returns PAM_TRY_AGAIN, then the check has failed, and
      passwords are not updated.

 RETURN VALUES    [Toc]    [Back]




 Hewlett-Packard Company            - 1 -   HP-UX 11i Version 2: August 2003






 pam_chauthtok(3)                                           pam_chauthtok(3)




      Upon successful completion, PAM_SUCCESS is returned.  In addition to
      the error return values described in pam(3), the following values may
      be returned:

      PAM_PERM_DENIED                     No permission.

      PAM_AUTHTOK_ERR                     Authentication token manipulation
                                          error.

      PAM_AUTHTOK_RECOVERY_ERR            Authentication information cannot
                                          be recovered.

      PAM_AUTHTOK_LOCK_BUSY               Authentication token lock busy.

      PAM_AUTHTOK_DISABLE_AGING           Authentication token aging
                                          disabled.

      PAM_USER_UNKNOWN                    User unknown to password service.

      PAM_TRY_AGAIN                       Preliminary check by password
                                          service failed.

 SEE ALSO    [Toc]    [Back]
      pam(3), pam_start(3), pam_authenticate(3).


 Hewlett-Packard Company            - 2 -   HP-UX 11i Version 2: August 2003