pam_sss(8)

1PAM_SSS(8)                     SSSD Manual pages                    PAM_SSS(8)
2
3
4

NAME

6       pam_sss - PAM module for SSSD
7

SYNOPSIS

9       pam_sss.so [quiet] [forward_pass] [use_first_pass] [use_authtok]
10                  [retry=N] [ignore_unknown_user] [ignore_authinfo_unavail]
11                  [domains=X] [allow_missing_name] [prompt_always]
12                  [try_cert_auth] [require_cert_auth]
13

DESCRIPTION

15       pam_sss.so is the PAM interface to the System Security Services daemon
16       (SSSD). Errors and results are logged through syslog(3) with the
17       LOG_AUTHPRIV facility.
18

OPTIONS

20       quiet
21           Suppress log messages for unknown users.
22
23       forward_pass
24           If forward_pass is set the entered password is put on the stack for
25           other PAM modules to use.
26
27       use_first_pass
28           The argument use_first_pass forces the module to use a previous
29           stacked modules password and will never prompt the user - if no
30           password is available or the password is not appropriate, the user
31           will be denied access.
32
33       use_authtok
34           When password changing enforce the module to set the new password
35           to the one provided by a previously stacked password module.
36
37       retry=N
38           If specified the user is asked another N times for a password if
39           authentication fails. Default is 0.
40
41           Please note that this option might not work as expected if the
42           application calling PAM handles the user dialog on its own. A
43           typical example is sshd with PasswordAuthentication.
44
45       ignore_unknown_user
46           If this option is specified and the user does not exist, the PAM
47           module will return PAM_IGNORE. This causes the PAM framework to
48           ignore this module.
49
50       ignore_authinfo_unavail
51           Specifies that the PAM module should return PAM_IGNORE if it cannot
52           contact the SSSD daemon. This causes the PAM framework to ignore
53           this module.
54
55       domains
56           Allows the administrator to restrict the domains a particular PAM
57           service is allowed to authenticate against. The format is a
58           comma-separated list of SSSD domain names, as specified in the
59           sssd.conf file.
60
61           NOTE: Must be used in conjunction with the “pam_trusted_users” and
62           “pam_public_domains” options. Please see the sssd.conf(5) manual
63           page for more information on these two PAM responder options.
64
65       allow_missing_name
66           The main purpose of this option is to let SSSD determine the user
67           name based on additional information, e.g. the certificate from a
68           Smartcard.
69
70           The current use case are login managers which can monitor a
71           Smartcard reader for card events. In case a Smartcard is inserted
72           the login manager will call a PAM stack which includes a line like
73
74               auth sufficient pam_sss.so allow_missing_name
75
76
77           In this case SSSD will try to determine the user name based on the
78           content of the Smartcard, returns it to pam_sss which will finally
79           put it on the PAM stack.
80
81       prompt_always
82           Always prompt the user for credentials. With this option
83           credentials requested by other PAM modules, typically a password,
84           will be ignored and pam_sss will prompt for credentials again.
85           Based on the pre-auth reply by SSSD pam_sss might prompt for a
86           password, a Smartcard PIN or other credentials.
87
88       try_cert_auth
89           Try to use certificate based authentication, i.e. authentication
90           with a Smartcard or similar devices. If a Smartcard is available
91           and the service is allowed for Smartcard authentication the use
92           will be prompted for a PIN and the certificate based authentication
93           will continue
94
95           If no Smartcard is available or certificate based authentication is
96           not allowed for the current service PAM_AUTHINFO_UNAVAIL is
97           returned.
98
99       require_cert_auth
100           Do certificate based authentication, i.e. authentication with a
101           Smartcard or similar devices. If a Smartcard is not available the
102           user will be prompted to insert one. SSSD will wait for a Smartcard
103           until the timeout defined by p11_wait_for_card_timeout passed,
104           please see sssd.conf(5) for details.
105
106           If no Smartcard is available after the timeout or certificate based
107           authentication is not allowed for the current service
108           PAM_AUTHINFO_UNAVAIL is returned.
109

MODULE TYPES PROVIDED

111       All module types (account, auth, password and session) are provided.
112

FILES

114       If a password reset by root fails, because the corresponding SSSD
115       provider does not support password resets, an individual message can be
116       displayed. This message can e.g. contain instructions about how to
117       reset a password.
118
119       The message is read from the file pam_sss_pw_reset_message.LOC where
120       LOC stands for a locale string returned by setlocale(3). If there is no
121       matching file the content of pam_sss_pw_reset_message.txt is displayed.
122       Root must be the owner of the files and only root may have read and
123       write permissions while all other users must have only read
124       permissions.
125
126       These files are searched in the directory
127       /etc/sssd/customize/DOMAIN_NAME/. If no matching file is present a
128       generic message is displayed.
129

AUTHORS

139       The SSSD upstream - https://pagure.io/SSSD/sssd/
140
141
142
143SSSD                              03/28/2019                        PAM_SSS(8)