All logins involving a password invoke the LGI$ICR_AUTHENTICATE
    callout routine. The routine is not called for subprocesses,
    network jobs invoked by proxy logins, or logged-in DECterm
    sessions.

    The following pointers are used in password authentication:

    o  Longword LGI$A_ICR_PWDCOUNT points to a location that contains
       the number of OpenVMS passwords for a particular account.
       Nonexistent accounts are assigned a password count of 1 to
       avoid revealing them by the absence of a password prompt.

    o  For DECwindows logins only, longword LGI$A_ICR_PWD1 points to
       a location that contains the user's primary password.

    o  For DECwindows logins only, longword LGI$A_ICR_PWD2 points
       to a location that contains the user's secondary password, if
       applicable.

    For all logins except DECwindows logins, the LGI$ICR_AUTHENTICATE
    callout routine may use the following callback routine sequence:

    o  Call LGI$ICB_PASSWORD for standard password prompting with an
       optional nonstandard prompt and the option of checking or just
       returning the password or other information obtained.

    o  Call LGI$ICB_GET_INPUT for completely customized prompting for
       each required piece of authentication information.

    For DECwindows logins, neither the LGI$ICB_PASSWORD callback
    routine nor the LGI$ICB_GET_INPUT callback routine needs to
    be called. The user enters the password using the DECwindows
    login dialog box before LOGINOUT issues the LGI$ICR_AUTHENTICATE
    callout.

    For a complete description of the DECwindows flow of control, see
    the description of the LGI$ICR_DECWINIT callout routine.

    All logins involving a password may invoke the LGI$ICB_VALIDATE
    callback routine. This routine validates against SYSUAF.DAT
    passwords obtained by customized prompting using descriptors
    for the user name and passwords. Optionally, the login may call
    the LGI$_ICB_CHECK_PASS callback routine to validate passwords.

    For interactive jobs, the LGI$ICR_AUTHENTICATE routine should
    check the DISUSER flag using the LGI$ICB_DISUSER callback routine
    to preserve the consistency of the "invalid user" behavior for
    disabled accounts. For other types of jobs, use the LGI$ICR_
    CHKRESTRICT callout routine to check the DISUSER flag.

                                   NOTE

       LOGINOUT checks the DISUSER flag as part of the
       authentication process because, if it is checked later,
       an intruder could determine that the correct user name and
       password had been entered and that the account is disabled.
       This is deliberately hidden by keeping the user in the retry
       loop for a disabled account.

       If the DISUSER flag is checked with other access
       restrictions in the authorization portion, this causes an
       immediate exit from LOGINOUT.

    Break-in detection, intrusion evasion, and security auditing are
    done in the case of any failure return from LGI$ICR_AUTHENTICATE.

    If this routine returns LGI$_SKIPRELATED, the user is fully
    authenticated, and no further authentication is done by either
    the site or OpenVMS. If this routine returns an error for
    an interactive job, the system retries the identification
    and authentication portions of LOGINOUT. For character-cell
    terminals, this consists of calling the LGI$ICR_IDENTIFY and
    LGI$ICR_AUTHENTICATE callout routines; for DECwindows terminals,
    this consists of calling the LGI$ICR_DECWINIT routine. The number
    of retries is specified by the SYSGEN parameter LGI_RETRY_LIM.