pam_roles(5)						Standards, Environments, and Macros					      pam_roles(5)

NAME

       pam_roles - Solaris Roles account management module

SYNOPSIS

       pam_roles.so.1

DESCRIPTION

       The  pam_roles module implements pam_sm_acct_mgmt(3PAM). It provides functionality to verify that a user is authorized to assume a role. It
       also prevents direct logins to a role. The user_attr(4) database is used to determine which users can assume which roles.

       The PAM items PAM_USER and    PAM_RUSER are used to determine the outcome of this module. PAM_USER represents the new identity being  veri-
       fied.  PAM_RUSER,  if  set,  represents the user asserting a new identity. If PAM_RUSER is not set, the real user ID of the calling service
       implies that the user is asserting a new identity. Notice that root can never have roles.

       This module is generally stacked above the pam_unix_account(5) module.

       The following options are interpreted:

       debug	       Provides syslog(3C) debugging information at the LOG_DEBUG level.

ERRORS

       The following values are returned:

       PAM_IGNORE	       If the type of the new user identity (PAM_USER) is "normal". Or, if the type of the new user identity is "role" and
			       the user asserting the new identity (PAM_RUSER) has the new identity  name in its list or roles.

       PAM_USER_UNKNOWN        No account is present for user.

       PAM_PERM_DENIED	       If  the type of the new user identity (PAM_USER) is "role" and the user asserting the new identity (PAM_RUSER) does
			       not have the new identity name in its list of roles.

EXAMPLES

       Example 1: Using the pam_roles.so.1 module

       Here are sample entries from pam.conf(4) demonstrating the use of the pam_roles.so.1 module:

       cron account required pam_unix_account.so.1
       #
       other account requisite pam_roles.so.1
       other account required pam_unix_account.so.1
       #

       The cron service does not invoke pam_roles.so.1. Delayed jobs are independent of role assumption. All other services verify that roles can-
       not  directly  login.  The "su" service (covered by the "other" service entry) verifies that if the new user is a role, the calling user is
       authorized for that role.

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Interface Stability	     |Evolving			   |
       +-----------------------------+-----------------------------+
       |MT Level		     |MT-Safe with exceptions	   |
       +-----------------------------+-----------------------------+

SEE ALSO

       roles(1), su(1M), libpam(3LIB), pam(3PAM), pam_acct_mgmt(3PAM), pam_setcred(3PAM), pam_set_item(3PAM), pam_sm_acct_mgmt(3PAM),  syslog(3C),
       pam.conf(4),	user_attr(4),	 attributes(5),    pam_authtok_check(5),    pam_authtok_get(5),    pam_authtok_store(5),    pam_dhkeys(5),
       pam_passwd_auth(5), pam_unix_account(5), pam_unix_auth(5), pam_unix_session(5)

NOTES

       The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle.

       This module should never be stacked alone. It never returns PAM_SUCCESS, as it never makes a positive decision.

SunOS 5.10							    9 Mar 2004							      pam_roles(5)