[exim] plaintext pam

hi,
can someone please tell me what is the expected content of
$auth1
$auth2
$auth3
(i thought: plain -> 2:user 3:secret, login -> 1:user 2:secret)


what is the expected argument to pam{}

and what actually happens in

server_condition = ${if pam{$auth2:${sg{$auth3}{:}{::}}}}

what is the substitution : -> :: for ?

i already tried to hardcode
server_condition = ${if pam{user:passwd}}
but did not work.

mainlog :
auth_plain authenticator failed for ([172.27.10.97]) [172.27.10.97]:49373
I=[172.27.10.90]:25: 535 Incorrect authentication data (set_id=ag)
# ag is username (system-user)

i use on another server a /etc/exim/passwd file
user : encrypted_secret : ?whatever?
and
server_condition = ${if
crypteq{$3}{${lookup{$2}lsearch{/etc/exim/passwd}{$value}{*}}{1}{0}}}
but on new server this does not work ?!

thanks in advance
andreas