backend

backend

Call a backend to fetch user authentication information.

backend {
    name "DB";
    query "FIND_USER";
}

The query statement is optional and may be omitted if the backend does not support multiple queries. In that case also the short form may be used:

backend "DB";

Result

Depending on the backend the backend action may return accept, reject or ignore.

Range

The optional range parameter slices the PAP authentication response before passing it to the backend. This is useful for two-factor scenarios where a combined <password><otp> value must be split between actions.

backend {
    name "YUBIKEY_CLOUD";
    range -44 0;
}

Add exclusive after the range to remove the matched portion instead of keeping it.

See YubiKey Authentication for a complete two-factor example.