...
pGina does not have a "repository of hashed windows passwords." Are you referring to the Windows local account store (SAM)? pGina works (in a typical LDAP-based configuration) by creating a local Windows account that has the same username and password as the LDAP account. That local account may be deleted after the user has logged out, if the Local Machine plugin is configured to do so. If it is not configured to do so, there may be a set of local accounts that is a subset of the LDAP accounts (those users who have logged on to the machine). Those accounts may or may not have the same password as the LDAP accounts depending on how the Local Machine plugin is configured (see the "Scramble
password after logout" option). For more information, please take a look at the documentation for the Local Machine plugin, and the pGina user's guide. Let me know if there is something that could be more clear.
o http://pgina.org/docs/local_machine.html
o http://pgina.org/docs/user.html
Thanks,
David