I've been reading everything I can find on PAM (e.g. http://wpollock.com/AUnix2/PAM-Help.htm), however I'm still confused about how precisely the advanced options are supposed to work. For example, every reference says this:
Each of the four control-flag keywords (required, requisite, sufficient, and
optional) have an equivalent expression in terms of the [...] syntax:
required
[success=ok new_authtok_reqd=ok ignore=ignore default=bad]
My understanding is that modules can return a variety of tokens, and that the action associated with each token is described in the configuration file. Based on that understanding, what does
new_authtok_reqd=ok
have to do with the required control flag? What's the meaning/purpose of
ignore=ignore ?
This alone:
success=ok
is what I would think matches the required behavior, but does
default=bad
mean that if the module returns any other action token, the module fails? Is the action=value token success=ok overruled by default=bad, or vice versa? Which takes precendence? It's not clear from anything I've read.
More generally, suppose I have something like
[success=done default=die]
What happens if the module returns success and one other token?
Finally, I can't find the answer to this question, either: can every value ok, done, bad, die, ignore, reset, N
be associated with any action? What would it even mean to say
[default=done] ?