# PAM service for localkdc-pam-auth.
#
# This file is intentionally minimal and MUST NOT include pam_sss.so.
# localkdc-pam-auth is the OTP backend for the localkdc KDC; if this
# service included pam_sss.so, SSSD's krb5 auth_provider would loop
# back through the KDC, creating an infinite authentication cycle:
#   KDC OTP preauth -> localkdc-pam-auth -> PAM -> pam_sss -> SSSD -> KDC -> ...
#
# pam_unix.so authenticates against NSS shadow entries.  For users
# created with "lkdcctl useradd", nss-systemd synthesises shadow
# records from /etc/userdb, so pam_unix.so can verify their passwords.

auth        required      pam_env.so
auth        sufficient    pam_unix.so
auth        required      pam_deny.so

account     required      pam_unix.so

password    sufficient    pam_unix.so yescrypt shadow
password    required      pam_deny.so
