Pam

pam 的验证
1. pam的libary -- adclient
2. pamdoeslegacyconflictexist -- 检查login的user是否存在uid/username 冲突. 如果没有, 验证通过.
3. get password
4. Pamverifypassword -- verify password. 验证password是否正确.
5. pam success

pam account managment
1. pamIsUserAllowAccess -- 检查user是否被允许登陆.如果是zone account enabled, ad account enabled, license is ok, workstation is allowed, allow/deny users/groups lists permit access. Does not check password expire.
2. 检查uid/username 是否冲突.
3. 检查password是否过期.
4. pam_success

pam cred
1. krb5cred -- give username/password, and存储它们filesystem中. 只有这个user可以读这个cred, 并且这个user必须是zoneuser.