ablish it is ready to update the user's authentication token it should return PAM_TRY_AGAIN, this information will be passed back to the application.

If the control value sufficient is used in the password stack, the PAM_PRELIM_CHECK section of the modules following that control value is not always executed.

PAM_UPDATE_AUTHTOK

  This informs the module that this is the call it should change the authorization tokens. If the flag is logically OR'd with PAM_CHANGE_EXPIRED_AUTHTOK, the token is only changed if it has actually expired.

The PAM library calls this function twice in succession. The first time with PAM_PRELIM_CHECK and then, if the module does not return PAM_TRY_AGAIN, subsequently with PAM_UPDATE_AUTHTOK. It is only on the second call that the authorization token is (possibly) changed.

#### 3.5.1.2. RETURN VALUES

PAM_AUTHTOK_ERR

  The module was unable to obtain the new authentication token.

PAM_AUTHTOK_RECOVERY_ERR

  The module was unable to obtain the old authentication token.

PAM_AUTHTOK_LOCK_BUSY

  Cannot change the authentication token since it is currently locked.

PAM_AUTHTOK_DISABLE_AGING

  Authentication token aging has been disabled.

PAM_PERM_DENIED

  Permission denied.

PAM_TRY_AGAIN

  Preliminary check was unsuccessful. Signals an immediate return to the application is desired.

PAM_SUCCESS

  The authentication token was successfully updated.

PAM_USER_UNKNOWN

  User unknown to password service.

Prev | Up | Next
3.4. Session management | Home | Chapter 4. Generic optional arguments