OK. It works now. Again I tested with and without the setting: setenv deferred_auth_pam 1 Both configurations work fine. If I have the setting enabled I get the following additional log entry: PLUGIN AUTH-PAM: BACKGROUND: <username>: deferred auth: PAM succeeded Otherwise I they look and work the same. What difference does the setting make?