1.\" The contents of this file are subject to the terms of the Common 2.\" Development and Distribution License (the "License"). You may not use 3.\" this file except in compliance with the License. 4.\" 5.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or 6.\" http://www.opensolaris.org/os/licensing. See the License for the 7.\" specific language governing permissions and limitations under the 8.\" License. 9.\" 10.\" When distributing Covered Code, include this CDDL HEADER in each file 11.\" and include the License file at usr/src/OPENSOLARIS.LICENSE. If 12.\" applicable, add the following below this CDDL HEADER, with the fields 13.\" enclosed by brackets "[]" replaced with your own identifying 14.\" information: Portions Copyright [yyyy] [name of copyright owner] 15.\" 16.\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved. 17.\" Copyright 2026 OmniOS Community Edition (OmniOSce) Association. 18.\" 19.Dd August 8, 2026 20.Dt GETAUTHATTR 3SECDB 21.Os 22.Sh NAME 23.Nm getauthattr , 24.Nm getauthnam , 25.Nm free_authattr , 26.Nm setauthattr , 27.Nm endauthattr , 28.Nm chkauthattr 29.Nd get authorization entry 30.Sh LIBRARY 31.Lb libsecdb 32.Sh SYNOPSIS 33.In auth_attr.h 34.In secdb.h 35.Ft "authattr_t *" 36.Fo getauthattr 37.Fa void 38.Fc 39.Ft "authattr_t *" 40.Fo getauthnam 41.Fa "const char *name" 42.Fc 43.Ft void 44.Fo free_authattr 45.Fa "authattr_t *auth" 46.Fc 47.Ft void 48.Fo setauthattr 49.Fa void 50.Fc 51.Ft void 52.Fo endauthattr 53.Fa void 54.Fc 55.Ft int 56.Fo chkauthattr 57.Fa "const char *authname" 58.Fa "const char *username" 59.Fc 60.Sh DESCRIPTION 61The 62.Fn getauthattr 63and 64.Fn getauthnam 65functions each return an 66.Xr auth_attr 5 67entry. 68Entries can come from any of the sources specified in the 69.Xr nsswitch.conf 5 70file. 71.Pp 72.Fn getauthattr 73enumerates 74.Xr auth_attr 5 75entries. 76.Fn getauthnam 77searches for an 78.Xr auth_attr 5 79entry with a given authorization name, 80.Fa name . 81Successive calls to these functions return either successive 82.Xr auth_attr 5 83entries or 84.Dv NULL . 85.Pp 86The internal representation of an 87.Xr auth_attr 5 88entry is an 89.Vt authattr_t 90structure defined in 91.In auth_attr.h 92with the following members: 93.Bd -literal -offset 4n 94char *name; /* name of the authorization */ 95char *res1; /* reserved for future use */ 96char *res2; /* reserved for future use */ 97char *short_desc; /* short description */ 98char *long_desc; /* long description */ 99kva_t *attr; /* array of key-value pair attributes */ 100.Ed 101.Pp 102The 103.Fn setauthattr 104function 105.Dq rewinds 106to the beginning of the enumeration of 107.Xr auth_attr 5 108entries. 109Calls to 110.Fn getauthnam 111can leave the enumeration in an indeterminate state. 112Therefore, 113.Fn setauthattr 114should be called before the first call to 115.Fn getauthattr . 116.Pp 117The 118.Fn endauthattr 119function may be called to indicate that 120.Xr auth_attr 5 121processing is complete; the system may then close any open 122.Xr auth_attr 5 123file, deallocate storage, and so forth. 124.Pp 125The 126.Fn chkauthattr 127function verifies whether or not a user has a given authorization. 128It first reads the 129.Sy AUTHS_GRANTED 130key in the 131.Xr policy.conf 5 132file and returns 1 if it finds a match for the given authorization. 133If 134.Fn chkauthattr 135does not find a match and the 136.Fa username 137is the name of the 138.Dq console user , 139defined as the owner of 140.Pa /dev/console , 141it first reads the 142.Sy CONSOLE_USER 143key in 144.Xr policy.conf 5 145and returns 1 if the given authorization is in any of the profiles 146specified in the 147.Sy CONSOLE_USER 148keyword, then reads the 149.Sy PROFS_GRANTED 150key in 151.Xr policy.conf 5 152and returns 1 if the given authorization is in any profiles specified with 153the 154.Sy PROFS_GRANTED 155keyword. 156If a match is not found from the default authorizations and default profiles, 157.Fn chkauthattr 158reads the 159.Xr user_attr 5 160database. 161If it does not find a match in 162.Xr user_attr 5 , 163it reads the 164.Xr prof_attr 5 165database, using the list of profiles assigned to the user, and checks if any of 166the profiles assigned to the user has the given authorization. 167The 168.Fn chkauthattr 169function returns 0 if it does not find a match in any of the three sources or 170if the user does not exist. 171.Pp 172A user is considered to have been assigned an authorization if either of the 173following are true: 174.Bl -bullet -width Ds 175.It 176The authorization name matches exactly any authorization assigned in the 177.Xr user_attr 5 178or 179.Xr prof_attr 5 180databases 181.Pq authorization names are case-sensitive . 182.It 183The authorization name suffix is not the key word 184.Sy grant 185and the authorization name matches any authorization up to the asterisk 186.Pq * 187character assigned in the 188.Xr user_attr 5 189or 190.Xr prof_attr 5 191databases. 192.El 193.Pp 194The examples in the following table illustrate the conditions under which a 195user is assigned an authorization. 196.Bl -column solaris.printer.postscript solaris.printer.postscript "authorized?" 197.It Ta Sy /etc/security/policy.conf , Ta Sy Is user 198.It Sy Authorization name Ta Sy user_attr No or Sy prof_attr No entry \ 199Ta Sy authorized\&? 200.It Sy -------------------------- Ta Sy ---------------------------- \ 201Ta Sy ----------- 202.It solaris.printer.postscript Ta solaris.printer.postscript Ta Yes 203.It solaris.printer.postscript Ta solaris.printer.* Ta Yes 204.It solaris.printer.grant Ta solaris.printer.* Ta "No" 205.El 206.Pp 207The 208.Fn free_authattr 209function releases memory allocated by the 210.Fn getauthnam 211and 212.Fn getauthattr 213functions. 214.Sh RETURN VALUES 215The 216.Fn getauthattr 217function returns a pointer to an 218.Vt authattr_t 219if it successfully enumerates an entry; otherwise it returns 220.Dv NULL , 221indicating the end of the enumeration. 222.Pp 223.Fn getauthnam 224returns a pointer to an 225.Vt authattr_t 226if it successfully locates the requested entry; otherwise it returns 227.Dv NULL . 228.Pp 229.Fn chkauthattr 230returns 1 if the user is authorized and 0 if the user does not exist or is not 231authorized. 232.Sh USAGE 233The 234.Fn getauthattr 235and 236.Fn getauthnam 237functions both allocate memory for the pointers they return. 238This memory should be deallocated with a call to 239.Fn free_authattr . 240.Pp 241Individual attributes in the 242.Fa attr 243field of 244.Vt authattr_t 245can be referred to by calling the 246.Xr kva_match 3SECDB 247function. 248.Sh WARNINGS 249Because the list of legal keys is likely to expand, code must be written to 250ignore unknown key-value pairs without error. 251.Sh FILES 252.Bl -tag -width Ds 253.It Pa /etc/nsswitch.conf 254configuration file lookup information for the name service switch 255.It Pa /etc/user_attr 256extended user attributes 257.It Pa /etc/security/auth_attr 258authorization attributes 259.It Pa /etc/security/policy.conf 260policy definitions 261.It Pa /etc/security/prof_attr 262profile information 263.El 264.Sh MT-LEVEL 265.Sy MT-Safe 266.Sh SEE ALSO 267.Xr getexecattr 3SECDB , 268.Xr getprofattr 3SECDB , 269.Xr getuserattr 3SECDB , 270.Xr kva_match 3SECDB , 271.Xr auth_attr 5 , 272.Xr nsswitch.conf 5 , 273.Xr policy.conf 5 , 274.Xr prof_attr 5 , 275.Xr user_attr 5 , 276.Xr attributes 7 , 277.Xr rbac 7 278