This section describes libuser: why it was written, and how it works. How the library is to be used will be described later.
When proper nsswitch functionality was introduced into glibc 2.0, it became possible to supply third-party facilities which would allow the standard C library (and by extension, all of a system's binaries) to pull information about users, protocols, and services from a variety of sources the glibc authors might not have anticipated.
The most common use for a new nsswitch module is supplementing the user and group databases, extending the data sources accessed over a network to a centrally-managed information store. This, along with the ability to authenticate users using networked servers (functionality provided by the increasingly-ubiquitous Linux-PAM library) and an enterprise-class networked filesystem, allows a properly-configured Linux workstation to participate as a full-fledged client in a large-scale network.
The facilities provided by PAM allow a user to log in and change her authentication tokens. The nsswitch interface allows any user (even unprivileged users like nobody) to look up information needed to run applications.
However, there are certain functions supplied by traditional isolated systems which such a networked workstation can't provide. Users have no method for modifying their non-essential information (chfn is broken), and the system administrator who previously had total power over the user and group databases must now perform all administration at the server using tools which are designed for general modification of the information store (hand-editing zone files for hesiod databases, ldapmodify, kadmin) instead of the traditionally-used tools.
The software which comes closest to meeting these needs is pwdb. However, the pwdb library has a few design limitations which make it unsuitable for this purpose. Like the standard files-based mechanisms, pwdb assumes that the superuser wields full power over the databases it interfaces with. The current version of pwdb provides no facilities for managing groups(?). The current version of pwdb can not be extended easily by third parties due to its reliance on static linking.
The libuser library implements a fully-modular system for reading, modifying, creating, and removing user and group accounts and account information. Modules which provide access to information stores can request information from the accessing user in order to authenticate to the information store.