# Configuration for pam_pkcs11 using the Safenet dongle.
# 
# see /usr/share/doc/libpam-pkcs11/README.gz for description of
# top-level configuration properties and common module properties.
#
# see /usr/share/doc/libpam-pkcs11/README.mapper.gz for presentation
# of what is a cert mapper, the two different login process using a
# mapper (important), and a description of provided mappers.
#
# see /usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example
# for a full configuration file with all modules and mappers.
#
pam_pkcs11 {

  nullok = true;
  debug = true; 
  use_first_pass = false;
  try_first_pass = false;
  use_authtok = false;
  card_only = true;
  use_pkcs11_module = safenet;
  use_mappers = uid,null;

  # Aladdin SAFENET
  pkcs11_module safenet {
    module = /usr/lib/libeToken.so
    description = "Aladdin safenet";
    slot_num = 0;
    #slot_description = "none";
    support_threads = false;
    ca_dir = /etc/pam_pkcs11/cacerts;
    crl_dir = /etc/pam_pkcs11/crls;
    nss_dir = /etc/pki/nssdb;
    cert_policy = ca,signature;
    token_type = "Smart card";
  }


  # uid  - Maps Subject Unique Identifier field (if exist) to login
  mapper uid {
	debug = true;
	module = internal;
	# module = /lib/x86_64-linux-gnu/pam_pkcs11/uid_mapper.so;
	ignorecase = false;
	mapfile = file:///etc/pam_pkcs11/uid_mapping;
	#mapfile = "none";
  }

  # Null ( no map ) mapper. when user as finder matchs to NULL or "nobody"
  mapper null {
	debug = true;
	# module = /lib/x86_64-linux-gnu/pam_pkcs11/null_mapper.so;
	module = internal ;
	# select behavior: always match, or always fail
	default_match = false;
	# on match, select returned user
        default_user = nobody ;
  }

}