This parameter allows you to execute arbitrary SQL statements each time an authentication request is received, but before authentication is done.

You can have as many AuthSQLStatement parameters as you like (i.e. 0 or more). Each one will have its special formatting macros replaced at run time (the ones of the format %{attribute-name} are probably the most useful). %0 is replaced with the quoted and escaped user name. They are executed in the order they appear in the configuration file, before AuthSelect is run. They are run even if AuthSelect is empty.