Zen

Source string Source string

298/10000 · 298

The string is read only.

English Actions
The expression syntax consists of feature names (e.g. _"feature"_) which returns _true_ if the feature is defined or _false_ if it is not defined and from the following logical operators: _and_, _or_ and _not_. The expression may also be enclosed in parentheses and contain multiple subexpressions.
For example:
*{if "feature1" or "feature2":true}*
If "feature1" or "feature2" is defined, replace this operator with string "true", otherwise with an empty string.
*{if not "feature":true|false}*
If "feature" is not defined, replace this operator with string "true", otherwise with string "false".
*{if not "feature":true}*
If "feature" is not defined, replace this operator with string "true", otherwise with an empty string.
*{if "feature1" and ("feature2" or "feature3"):true}*
If "feature1" is defined, and one of "feature2" and "feature3" is defined replace this operator with string "true", otherwise with an empty string.
EXAMPLE
Here is an example of using "if" operator. If "with-sudo" feature is enabled, it will add "sss" to sudoers line.
passwd: sss files
group: sss files
netgroup: sss files
automount: sss files
services: sss files
sudoers: files {if "with-sudo":sss}
Here is an example of "continue-if" and "include-if" operators. The resulting file will be empty unless "with-smartcard" feature is enabled. If it is enabled and also "with-faillock" feature is enabled, it will also enable support for pam_faillock.
{continue if "with-smartcard"}
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth required pam_faillock.so preauth silent deny=4 unlock_time=1200 {include if "with-faillock"}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_faillock.so authfail deny=4 unlock_time=1200 {include if "with-faillock"}
auth required pam_deny.so
...
Here is an example of "continue-if" using logical expression. The file will be empty unless "with-smartcard" or "with-smartcard-required" is set. This will simplify the call of _authselect select_ command which does not have to include both features but only "with-smartcard-required" is necessary.
{continue if "with-smartcard" or "with-smartcard-required"}
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth required pam_faillock.so preauth silent deny=4 unlock_time=1200 {include if "with-faillock"}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_faillock.so authfail deny=4 unlock_time=1200 {include if "with-faillock"}
auth required pam_deny.so
...
Here is an example of "imply-if" operator. Enabling feature "with-smartcard-required" will also enable "with-smartcard" to make sure that all relevant PAM modules are used. This will achieve the same behavior as the previous example.
{imply "with-smartcard" if "with-smartcard-required"}
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth [success=1 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:kde:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid {include if "with-smartcard-required"}
auth [success=done ignore=ignore default=die] pam_sss.so require_cert_auth ignore_authinfo_unavail {include if "with-smartcard-required"}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so {exclude if "with-smartcard"}
auth [default=2 ignore=ignore success=ok] pam_localuser.so {include if "with-smartcard"}
auth [success=done authinfo_unavail=ignore user_unknown=ignore ignore=ignore default=die] pam_sss.so try_cert_auth {include if "with-smartcard"}
auth sufficient pam_unix.so {if not "without-nullok":nullok}
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
...
CREATING A NEW PROFILE
To register a new profile within authselect, create a directory in one of the authselect profile locations with the files listed above. Not all of the files must be present, only *README* is mandatory. Other files can be created on per-need basis.
You may find *authselect create-profile* command helpful when creating new profile. See *authselect(8)* manual page or *authselect create-profile --help* for more information.
SEE ALSO
authselect(8), nsswitch.conf(5), PAM(8)

Loading…

User avatar minerva

Comment added

  1. authselect
  2. 1.2.x-authselect-profiles.5.adoc
  3. English

Here is an example of "continue-if" using a logical expression. The file will be empty unless "with-smartcard" or "with-smartcard-required" is set. This will simplify the call of authselect select because it does not have to include both features, only "with-smartcard-required" is necessary.

a year ago
User avatar None

String updated in the repository

  1. authselect
  2. 1.2.x-authselect-profiles.5.adoc
  3. English
Here is an example of "continue-if" using logical expression. The file will be empty unless "with-smartcard" or "with-smartcard-required" is set. This will simplify the call of _authselect select_ command which does not have to include both features but only "with-smartcard-required" is necessary.
Here is an example of "continue-if" using logical expression. The file will be empty unless "with-smartcard" or "with-smartcard-required" is set. This will simplify the call of _authselect select_ command which does not have to include both features but only "with-smartcard-required" is necessary.
2 years ago
Browse all string changes
User avatar minerva

Source string comment

Here is an example of "continue-if" using a logical expression. The file will be empty unless "with-smartcard" or "with-smartcard-required" is set. This will simplify the call of authselect select because it does not have to include both features, only "with-smartcard-required" is necessary.

a year ago

Things to check

Comments

There is 1 unresolved comment for this string.

View

Glossary

English English
No related strings found in the glossary.

String information

Source string description
type: Plain text
Flags
c-format, read-only
Source string location
./src/man/authselect-profiles.5.adoc:168
String age
2 years ago
Last updated
11 months ago
Source string age
2 years ago
Translation file
src/man/po/authselect-profiles.5.adoc.pot, string 62