Date: Fri, 23 May 2003 22:37:24 +0300 From: Ruslan Ermilov <ru@FreeBSD.org> To: Dag-Erling Smorgrav <des@ofug.org> Cc: current@FreeBSD.org Subject: Re: 5.1 beta2 still in trouble with pam_ldap Message-ID: <20030523193724.GA9240@sunbay.com> In-Reply-To: <xzpr86pwx5m.fsf@flood.ping.uio.no> References: <20030522184631.A23366@bart.esiee.fr> <xzp65o2zkhf.fsf@flood.ping.uio.no> <20030522224850.GK87863@roark.gnf.org> <xzpof1uy28n.fsf@flood.ping.uio.no> <20030523060846.GC17107@sunbay.com> <xzp4r3mxjrx.fsf@flood.ping.uio.no> <20030523062848.GG17107@sunbay.com> <xzpr86pwx5m.fsf@flood.ping.uio.no>
next in thread | previous in thread | raw e-mail | index | archive | help
--FCuugMFkClbJLl1L Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, May 23, 2003 at 04:33:09PM +0200, Dag-Erling Smorgrav wrote: > Ruslan Ermilov <ru@freebsd.org> writes: > > In a chain with mutiple "binding" modules, only the _last_ > > failure gets ignored? Meaning, if some other module succeeds, > > override the failure status, right? >=20 > Failure of a "binding" module causes the entire chain to fail once it > has completed. The error returned is that returned by the first > non-"optional", non-"sufficient" module that failed. >=20 > Failure of a "sufficient" module, on the other hand, is always ignored > (so if no other non-"optional", non-"sufficient" module failed, the > chain will succeed). This is what constantly surprises users, and > what "binding" was introduced to alleviate. >=20 > See the PAM article for details - particularly the following two > sections: >=20 > http://www.freebsd.org/doc/en/articles/pam/pam-essentials.html#PAM-CHAINS= -POLICIES > http://www.freebsd.org/doc/en/articles/pam/pam-config.html#PAM-POLICIES >=20 Thanks, DES! I think I now understand this much better. :-) And I have the following question for you: Why pam_nologin in the "auth" chain of the "login" service is marked "required" and not "requisite", and why do we have the "required" at all? What's the point in continuing with the chain if we are going to return the failure anyway? What's the real application of "required" as compared to "requisite"? Cheers, --=20 Ruslan Ermilov Sysadmin and DBA, ru@sunbay.com Sunbay Software AG, ru@FreeBSD.org FreeBSD committer, +380.652.512.251 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age --FCuugMFkClbJLl1L Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (FreeBSD) iD8DBQE+znh0Ukv4P6juNwoRAuj5AJ935TMWugv8J6C0eeovQe8Zp71/9gCdGCSD nzgz2fpm1KQtgUMdSODU7pI= =lhUn -----END PGP SIGNATURE----- --FCuugMFkClbJLl1L--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030523193724.GA9240>