1 '\" -*- coding: utf-8 -*- 2 .if \n(.g .ds T< \\FC 3 .if \n(.g .ds T> \\F[\n[.fam]] 4 .de URL 5 \\$2 \(la\\$1\(ra\\$3 6 .. 7 .if \n(.g .mso www.tmac 8 .TH pam_ldap 8 "Nov 2021" "Version 0.9.12" "System Manager's Manual" 9 .SH NAME 10 pam_ldap \- PAM module for LDAP-based authentication 11 .SH SYNOPSIS 12 'nh 13 .fi 14 .ad l 15 \fBpam_ldap.so\fR \kx 16 .if (\nx>(\n(.l/2)) .nr x (\n(.l/5) 17 'in \n(.iu+\nxu 18 [\fI...\fR] 19 'in \n(.iu-\nxu 20 .ad b 21 'hy 22 .SH DESCRIPTION 23 This is a PAM module that uses an 24 LDAP server to verify user access rights and 25 credentials. 26 .SH OPTIONS 27 .TP 28 \*(T<\fBuse_first_pass\fR\*(T> 29 Specifies that the PAM module should use the first 30 password provided in the authentication stack and not prompt the user 31 for a password. 32 .TP 33 \*(T<\fBtry_first_pass\fR\*(T> 34 Specifies that the PAM module should use the first 35 password provided in the authentication stack and if that fails prompt 36 the user for a password. 37 .TP 38 \*(T<\fBnullok\fR\*(T> 39 Specifying this option allows users to log in with a blank password. 40 Normally logins without a password are denied. 41 .TP 42 \*(T<\fBignore_unknown_user\fR\*(T> 43 Specifies that the PAM module should return 44 PAM_IGNORE for users that are not present in the LDAP 45 directory. 46 This causes the PAM framework to ignore this module. 47 .TP 48 \*(T<\fBignore_authinfo_unavail\fR\*(T> 49 Specifies that the PAM module should return 50 PAM_IGNORE if it cannot contact the LDAP server. 51 This causes the PAM framework to ignore this module. 52 .TP 53 \*(T<\fBno_warn\fR\*(T> 54 Specifies that warning messages should not be propagated to the 55 PAM application. 56 .TP 57 \*(T<\fBuse_authtok\fR\*(T> 58 This causes the PAM module to use the earlier 59 provided password when changing the password. The module will not 60 prompt the user for a new password (it is analogous to 61 \*(T<\fBuse_first_pass\fR\*(T>). 62 .TP 63 \*(T<\fBdebug\fR\*(T> 64 This option causes the PAM module to log debugging 65 information to 66 \fBsyslog\fR(3). 67 .TP 68 \*(T<\fBminimum_uid=\fR\*(T>\fIUID\fR 69 This option causes the PAM module to ignore the user 70 if the user id is lower than the specified value. This can be used to 71 bypass LDAP checks for system users 72 (e.g. by setting it to \*(T<1000\*(T>). 73 .SH "MODULE SERVICES PROVIDED" 74 All services are provided by this module but currently sessions changes 75 are not implemented in the nslcd daemon. 76 .SH FILES 77 .TP 78 \*(T<\fI/etc/pam.conf\fR\*(T> 79 the main PAM configuration file 80 .TP 81 \*(T<\fI/etc/nslcd.conf\fR\*(T> 82 The configuration file for the \fBnslcd\fR daemon 83 (see \fBnslcd.conf\fR(5)) 84 .SH "SEE ALSO" 85 \fBpam.conf\fR(5), 86 \fBnslcd\fR(8), 87 \fBnslcd.conf\fR(5) 88 .SH AUTHOR 89 This manual was written by Arthur de Jong <arthur@arthurdejong.org>.