---
name: "pam_get_authtok_noverify"
section: "3"
platform: "linux"
package: "libpam-doc"
version: "1.7.0-5"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/pam_get_authtok"
---

# pam\_get\_authtok\_noverify(3)

get authentication token

Part of [pam\_get\_authtok(3)](/pam_get_authtok/3.md).

## NAME

pam\_get\_authtok, pam\_get\_authtok\_verify, pam\_get\_authtok\_noverify - get authentication token

## SYNOPSIS

```
#include <security/pam_ext.h>
```

**int pam\_get\_authtok(pam\_handle\_t \****pamh***, int** *item***, const char \*\****authtok***, const char \****prompt***);**

**int pam\_get\_authtok\_noverify(pam\_handle\_t \****pamh***, const char \*\****authtok***, const char \****prompt***);**

**int pam\_get\_authtok\_verify(pam\_handle\_t \****pamh***, const char \*\****authtok***, const char \****prompt***);**

## DESCRIPTION

The **pam\_get\_authtok** function returns the cached authentication token, or prompts the user if no token is currently cached. It is intended for internal use by Linux-PAM and PAM service modules. Upon successful return, *authtok* contains a pointer to the value of the authentication token. Note, this is a pointer to the *actual* data and should **not** be *free()*'ed or over-written!

The *prompt* argument specifies a prompt to use if no token is cached. If a NULL pointer is given, **pam\_get\_authtok** uses pre-defined prompts.

The following values are supported for *item*:

PAM\_AUTHTOK

Returns the current authentication token. Called from [**pam\_sm\_chauthtok**(3)](/pam_sm_chauthtok/3.md) **pam\_get\_authtok** will ask the user to confirm the new token by retyping it. If a prompt was specified, "Retype" will be used as prefix.

PAM\_OLDAUTHTOK

Returns the previous authentication token when changing authentication tokens.

The **pam\_get\_authtok\_noverify** function can only be used for changing the password (from [**pam\_sm\_chauthtok**(3)](/pam_sm_chauthtok/3.md)). It returns the cached authentication token, or prompts the user if no token is currently cached. The difference to **pam\_get\_authtok** is, that this function does not ask a second time for the password to verify it. Upon successful return, *authtok* contains a pointer to the value of the authentication token. Note, this is a pointer to the *actual* data and should **not** be *free()*'ed or over-written!

The **pam\_get\_authtok\_verify** function can only be used to verify a password for mistypes gotten by [**pam\_get\_authtok\_noverify**(3)](/pam_get_authtok_noverify/3.md). This function asks a second time for the password and verify it with the password provided by *authtok* argument. In case of an error, the value of *authtok* is undefined. Else this argument will point to the *actual* data and should **not** be *free()*'ed or over-written!

## OPTIONS

**pam\_get\_authtok** honours the following module options:

try\_first\_pass

Before prompting the user for their password, the module first tries the previous stacked module's password in case that satisfies this module as well.

use\_first\_pass

The argument **use\_first\_pass** forces the module to use a previous stacked modules password and will never prompt the user - if no password is available or the password is not appropriate, the user will be denied access.

use\_authtok

When password changing enforce the module to set the new token to the one provided by a previously stacked **password** module. If no token is available token changing will fail.

authtok\_type=XXX

The default action is for the module to use the following prompts when requesting passwords: "New UNIX password: " and "Retype UNIX password: ". The example word *UNIX* can be replaced with this option, by default it is empty.

## RETURN VALUES

PAM\_AUTH\_ERR

Authentication token could not be retrieved.

PAM\_AUTHTOK\_ERR

New authentication could not be retrieved.

PAM\_SUCCESS

Authentication token was successfully retrieved.

PAM\_SYSTEM\_ERR

A NULL pointer was specified as the PAM handle, or no space for an authentication token was provided.

PAM\_TRY\_AGAIN

New authentication tokens mismatch.

## SEE ALSO

[**pam**(7)](/pam/7.md)

## STANDARDS

The **pam\_get\_authtok** function is a Linux-PAM extensions.