<domain> <type> <item> <value>

Where:
<domain> can be:

an user name
a group name, with @group syntax
the wildcard *, for default entry
the wildcard %, can be also used with %group syntax, for maxlogin limit