16.3.2. Control Flag
required— The module result must be successful for authentication to continue. If a
requiredmodule result fails, the user is not notified until results on all modules referencing that interface are completed.
requisite— The module result must be successful for authentication to continue. However, if a
requisitemodule result fails, the user is notified immediately with a message reflecting the first failed
sufficient— The module result is ignored if it fails. However, if a
sufficientflagged module result is successful and no
requiredflagged modules above it have failed, then no other results are required and the user is authenticated to the service.
optional— The module result is ignored. A module flagged as
optionalonly becomes necessary for successful authentication when there are no other modules referencing the interface.
requiredmodules are called is not critical. The
requisitecontrol flags cause order to become important.
/usr/share/doc/pam-<version-number>/directory for information on this new syntax (where <version-number> is the version number for PAM).