3 Python PAM modules

When a PAM handle created by the applications call to pam_start(3) first uses a Python PAM module, pam_python invokes it using Python's execfile function. The following variables are passed to the invoked module in its global namespace:

__builtins__
The usual Python __builtins__.

__file__
The absolute path name to the Python PAM module.

As described in the PAM Module Writers Guide, PAM interacts with your module by calling its methods. Each type in the PAM configuration rules results in one or more methods being called. The Python PAM module must define the methods that will be called by each rule type it can be used with. Those methods are:

pam_sm_acct_mgmt( pamh, flags, args)
The service module's implementation of the pam_acct_mgmt(3) interface.

pam_sm_authenticate( pamh, flags, args)
The service module's implementation of the pam_authenticate(3) interface.

pam_sm_close_session( pamh, flags, args)
The service module's implementation of the pam_close_session(3) interface.

pam_sm_chauthtok( pamh, flags, args)
The service module's implementation of the pam_chauthtok(3) interface.

pam_sm_open_session( pamh, flags, args)
The service module's implementation of the pam_open_session(3) interface.

pam_sm_setcred( pamh, flags, args)
The service module's implementation of the pam_setcred(3) interface.

The arguments and return value of all these methods are the same. The pamh parameter is an instance of the PamHandle class. It is used to interact with PAM and is described in the next section. The remaining arguments are as described in the PAM Module Writers Guide. All functions must return an integer, eg pamh.PAM_SUCCESS. The valid return codes for each function are defined PAM Module Writers Guide. If the Python method isn't present pam_python will return pamh.PAM_SYMBOL_ERR to PAM; if the method or doesn't return an integer or throws an exception pamh.PAM_SERVICE_ERR is returned.

There is one other method that can be defined by the Python PAM module. Its optional:

pam_sm_end( pamh)
If present this will be called when the application calls pam_end(3). If not present nothing happens. The parameter pamh is the PamHandle object. The return value is ignored.