This option has to be used if you have a buggy version of glibc. It is known that glibc 2.3.2 implementation of getgrouplist is buggy and thus you need to manually set the option to the maximum number of groups a user can belong to.
Default: system_glibc_cant_guess_maxgroups=0
This option has to be used as PAM is not threadsafe.
Default: system_pam_module_not_threadsafe=1
When username is given with "DOMAIN\user" it calls pam authentication with username equal to "user" if option is set to 1.
Default: system_suppress_prefixed_domain=0