Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 23 May 2003 22:37:24 +0300
From:      Ruslan Ermilov <ru@FreeBSD.org>
To:        Dag-Erling Smorgrav <des@ofug.org>
Cc:        current@FreeBSD.org
Subject:   Re: 5.1 beta2 still in trouble with pam_ldap
Message-ID:  <20030523193724.GA9240@sunbay.com>
In-Reply-To: <xzpr86pwx5m.fsf@flood.ping.uio.no>
References:  <20030522184631.A23366@bart.esiee.fr> <xzp65o2zkhf.fsf@flood.ping.uio.no> <20030522224850.GK87863@roark.gnf.org> <xzpof1uy28n.fsf@flood.ping.uio.no> <20030523060846.GC17107@sunbay.com> <xzp4r3mxjrx.fsf@flood.ping.uio.no> <20030523062848.GG17107@sunbay.com> <xzpr86pwx5m.fsf@flood.ping.uio.no>

next in thread | previous in thread | raw e-mail | index | archive | help

--FCuugMFkClbJLl1L
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, May 23, 2003 at 04:33:09PM +0200, Dag-Erling Smorgrav wrote:
> Ruslan Ermilov <ru@freebsd.org> writes:
> > In a chain with mutiple "binding" modules, only the _last_
> > failure gets ignored?  Meaning, if some other module succeeds,
> > override the failure status, right?
>=20
> Failure of a "binding" module causes the entire chain to fail once it
> has completed.  The error returned is that returned by the first
> non-"optional", non-"sufficient" module that failed.
>=20
> Failure of a "sufficient" module, on the other hand, is always ignored
> (so if no other non-"optional", non-"sufficient" module failed, the
> chain will succeed).  This is what constantly surprises users, and
> what "binding" was introduced to alleviate.
>=20
> See the PAM article for details - particularly the following two
> sections:
>=20
> http://www.freebsd.org/doc/en/articles/pam/pam-essentials.html#PAM-CHAINS=
-POLICIES
> http://www.freebsd.org/doc/en/articles/pam/pam-config.html#PAM-POLICIES
>=20
Thanks, DES!  I think I now understand this much better.  :-)

And I have the following question for you:

Why pam_nologin in the "auth" chain of the "login" service is marked
"required" and not "requisite", and why do we have the "required" at
all?  What's the point in continuing with the chain if we are going
to return the failure anyway?  What's the real application of
"required" as compared to "requisite"?


Cheers,
--=20
Ruslan Ermilov		Sysadmin and DBA,
ru@sunbay.com		Sunbay Software AG,
ru@FreeBSD.org		FreeBSD committer,
+380.652.512.251	Simferopol, Ukraine

http://www.FreeBSD.org	The Power To Serve
http://www.oracle.com	Enabling The Information Age

--FCuugMFkClbJLl1L
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iD8DBQE+znh0Ukv4P6juNwoRAuj5AJ935TMWugv8J6C0eeovQe8Zp71/9gCdGCSD
nzgz2fpm1KQtgUMdSODU7pI=
=lhUn
-----END PGP SIGNATURE-----

--FCuugMFkClbJLl1L--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030523193724.GA9240>