pam_sm_acct_mgmt(3)                                     pam_sm_acct_mgmt(3)




 NAME    [Toc]    [Back]
      pam_sm_acct_mgmt - Service provider implementation for pam_acct_mgmt

 SYNOPSIS    [Toc]    [Back]
      cc [ flag ... ] file ...  -lpam [ library ... ]

      #include <security/pam_appl.h>

      #include <security/pam_modules.h>

      int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc,
           const char **argv);

 DESCRIPTION    [Toc]    [Back]
      In response to a call to pam_acct_mgmt(3), the PAM framework calls
      pam_sm_acct_mgmt() from the modules listed in the pam.conf(4) file.
      The account management provider supplies the back-end functionality
      for this interface function.  The applications should not call this
      API directly.

      The function, pam_sm_acct_mgmt(), determines whether the current
      user's account and password are valid.  This includes checking for
      password and account expiration, valid log-in times, etc.  The user in
      question is specified by a prior call to pam_start(), and is
      referenced by the authentication handle, pamh, which is passed as the
      first argument to pam_sm_acct_mgmt().  The following flags may be set
      in the flags field:

      PAM_SILENT    [Toc]    [Back]
           The account management service should not generate any messages.

      PAM_DISALLOW_NULL_AUTHTOK    [Toc]    [Back]
           The account management service should return PAM_AUTHTOKEN_REQD
           if the user has a null authentication token.

      The argc argument represents the number of module options passed in
      from the configuration file pam.conf(4).  argv specifies the module
      options, which are interpreted and processed by the account management
      service.  Please refer to the specific module man pages for the
      various available options. If an unknown option is passed to the
      module, an error should be logged through syslog(3C) and the option
      ignored.

      If an account management module determines that the user password has
      aged or expired, it should save this information as state in the
      authentication handle, pamh, using pam_set_data().  pam_chauthtok()
      uses this information to determine which passwords have expired.

 APPLICATION USAGE    [Toc]    [Back]
      Refer to pam(3) for information on thread-safety of PAM interfaces.




 Hewlett-Packard Company            - 1 -   HP-UX 11i Version 2: August 2003






 pam_sm_acct_mgmt(3)                                     pam_sm_acct_mgmt(3)




 RETURN VALUES    [Toc]    [Back]
      If there are no restrictions to logging in, PAM_SUCCESS is returned.
      The following error values may also be returned upon error:

      PAM_USER_UNKNOWN              User not known to underlying
                                    authentication module.

      PAM_AUTHTOKEN_REQD            New authentication token required.

      PAM_ACCT_EXPIRED              User account has expired.

      PAM_PERM_DENIED               User denied access to account at this
                                    time.

      PAM_IGNORE                    Ignore underlying account module
                                    regardless of whether the control flag
                                    is required, optional or sufficient

      PAM_ACCT_DISABLED             User account has been disabled (trusted
                                    mode only).

      PAM_TERM_DISABLED             Terminal has been disabled (trusted mode
                                    only).

      PAM_NOT_AUTHORIZED            User is not authorized for terminal
                                    access (trusted mode only).

      PAM_NOT_RTIME                 Wrong time to login (trusted mode only).

 SEE ALSO    [Toc]    [Back]
      pam(3), pam_acct_mgmt(3), syslog(3C), pam.conf(4).


 Hewlett-Packard Company            - 2 -   HP-UX 11i Version 2: August 2003