auth    requisite       pam_nologin.so
auth    required        pam_env.so readenv=1
auth    required        pam_env.so readenv=1 envfile=/etc/default/locale
auth    required        pam_env.so readenv=1 envfile=/etc/environment.puavo
auth    optional        pam_group.so

# guest user
auth    [success=ok default=2]  pam_succeed_if.so user ingroup guest
auth    required                pam_puavo.so exitcode_to_pam quiet /usr/lib/puavo-ltsp-client/pam/puavo-login
auth    sufficient              pam_permit.so

# puavo users

auth    [authinfo_unavail=ignore success=1 perm_denied=2 default=6]   pam_puavo.so      exitcode_to_pam expose_authtok quiet set_krb5ccname /usr/lib/puavo-ltsp-client/pam/puavo-login immediate
auth    [success=6 default=2]           pam_ccreds.so   action=validate ccredsfile=/var/cache/ccreds/ccreds.db use_first_pass
auth    [default=6]                     pam_ccreds.so   action=store ccredsfile=/var/cache/ccreds/ccreds.db
auth    [default=3]                     pam_ccreds.so   action=update ccredsfile=/var/cache/ccreds/ccreds.db
auth    required                        pam_puavo.so    exitcode_to_pam quiet /usr/lib/puavo-ltsp-client/pam/puavo-login cached-fail
auth    optional                        pam_echo.so     file=/etc/puavo-conf/files/messages/auth_unavailable.1
auth    optional                        pam_echo.so     file=/etc/puavo-conf/files/messages/auth_unavailable.2
auth    requisite                       pam_deny.so
auth    optional                        pam_puavo.so    exitcode_to_pam expose_authtok quiet /usr/lib/puavo-ltsp-client/pam/puavo-login cached-auth

auth    optional        pam_exec.so quiet /usr/lib/puavo-ltsp-client/pam/puavo-setup-primary-user
auth    optional        pam_gnome_keyring.so
auth    optional        pam_exec.so quiet /usr/lib/puavo-ltsp-client/pam/puavo-manage-user-role-groups
auth    sufficient      pam_permit.so
