X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/61d58bb6d4687c0794137700df1ba6aca418a191..b28098a9199e87659046307129b9226749ebf9b6:/lib/pam/README

diff --git a/lib/pam/README b/lib/pam/README
index 243a179e6c..8c5e10ed60 100644
--- a/lib/pam/README
+++ b/lib/pam/README
@@ -1 +1,18 @@
 For configuration advice, please refer to https://doc.arvados.org/install/install-webshell.html
+
+Usage (in pam config):
+
+    pam_arvados.so arvados_api_host my_vm_hostname ["insecure"] ["debug"]
+
+pam_arvados.so passes authentication if (according to
+arvados_api_host) the supplied PAM token belongs to an Arvados user
+who is allowed to log in to my_vm_host_name with the supplied PAM
+username.
+
+If my_vm_hostname is omitted or "-", the current hostname is used.
+
+"insecure" -- continue even if the TLS certificate presented by
+arvados_api_host fails verification.
+
+"debug" -- enable debug-level log messages in syslog and (when not in
+"silent" mode) on the calling application's stderr.