SherbyNet - /page/wikibook/entry.mu

Micron Document

`:top

A `!pluggable authentication module`! (`!PAM`!) is a mechanism to integrate multiple low-level `F33f`_`[authentication`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Authentication]`_`f schemes into a high-level `F33f`_`[application programming interface`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Application_programming_interface]`_`f (API). PAM allows programs that rely on authentication to be written independently of the underlying authentication scheme. It was first proposed by `F33f`_`[Sun Microsystems`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Sun_Microsystems]`_`f in an `F33f`_`[Open Software Foundation`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Open_Software_Foundation]`_`f `F33f`_`[Request for Comments`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Request_for_Comments]`_`f (RFC) 86.0 dated October 1995.`:cite-ref-1[`F5bf`_`[1`#cite-note-1]`_`f] It was adopted as the authentication framework of the `F33f`_`[Common Desktop Environment`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Common_Desktop_Environment]`_`f. As a stand-alone `F33f`_`[open-source`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Open-source]`_`f infrastructure, PAM first appeared in `F33f`_`[Red Hat Linux`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Red_Hat_Linux]`_`f 3.0.4 in August 1996 in the `F33f`_`[Linux PAM`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Linux_PAM]`_`f project. PAM is currently supported in the `F33f`_`[AIX operating system`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=AIX_operating_system]`_`f, `F33f`_`[DragonFly BSD`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=DragonFly_BSD]`_`f,`:cite-ref-2[`F5bf`_`[2`#cite-note-2]`_`f] `F33f`_`[FreeBSD`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=FreeBSD]`_`f, `F33f`_`[HP-UX`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=HP-UX]`_`f, `F33f`_`[Linux`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Linux]`_`f, `F33f`_`[macOS`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=MacOS]`_`f, `F33f`_`[NetBSD`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=NetBSD]`_`f and `F33f`_`[Solaris`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Solaris_(operating_system)]`_`f.

Since no central standard of PAM behavior exists, there was a later attempt to standardize PAM as part of the `F33f`_`[X/Open`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=X/Open]`_`f UNIX standardization process, resulting in the `!X/Open Single Sign-on`! (`!XSSO`!) standard. This standard was not ratified, but the standard draft has served as a reference point for later PAM implementations (for example, `F33f`_`[OpenPAM`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=OpenPAM]`_`f).

>>Contents

• `F0af`_`[Criticisms`#criticisms]`_`f

• `F0af`_`[See also`#see-also]`_`f

• `F0af`_`[References`#references]`_`f

• `F0af`_`[External links`#external-links]`_`f

-─

>>Criticisms

Since most PAM implementations do not interface with remote clients themselves, PAM, on its own, cannot implement `F33f`_`[Kerberos`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Kerberos_(protocol)]`_`f, the most common type of `F33f`_`[SSO`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Single_sign-on]`_`f used in Unix environments. This led to SSO's incorporation as the "primary authentication" portion of the would-be XSSO standard and the advent of technologies such as `F33f`_`[SPNEGO`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=SPNEGO]`_`f and `F33f`_`[SASL`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Simple_Authentication_and_Security_Layer]`_`f. This lack of functionality is also the reason `F33f`_`[SSH`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Secure_Shell]`_`f does its own authentication mechanism negotiation.

In most PAM implementations, pam_krb5 only fetches `F33f`_`[Ticket Granting Tickets`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Ticket_Granting_Ticket]`_`f, which involves prompting the user for credentials, and this is only used for the initial login in an SSO environment. To fetch a service ticket for a particular application, and not prompt the user to enter credentials again, that application must be specifically coded to support Kerberos. This is because pam_krb5 cannot itself get service tickets, although there are versions of PAM-KRB5 that are attempting to work around the issue.`:cite-ref-3[`F5bf`_`[3`#cite-note-3]`_`f]

>>See also

• Implementations:

• `F33f`_`[Java Authentication and Authorization Service`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Java_Authentication_and_Authorization_Service]`_`f

• `F33f`_`[Linux PAM`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Linux_PAM]`_`f

• `F33f`_`[OpenPAM`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=OpenPAM]`_`f

• `F33f`_`[Identity management`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Identity_management]`_`f – the general topic

• `F33f`_`[Name Service Switch`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Name_Service_Switch]`_`f – manages user databases

• `F33f`_`[System Security Services Daemon`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=System_Security_Services_Daemon]`_`f – SSO implementation based on PAM and NSS

>>References

`:cite-note-1`!1.`! `F0af`_`[↑`#cite-ref-1]`_`f The Original Solaris PAM RFC

`:cite-note-2`!2.`! `F0af`_`[↑`#cite-ref-2]`_`f PAM manual page of DragonFly BSD

`:cite-note-3`!3.`! `F0af`_`[↑`#cite-ref-3]`_`f PAM-KRB5

>>External links

Specifications:

• The Original Solaris PAM RFC

• X/Open Single Sign-on (XSSO) 1997 Draft Working Paper

Guides:

• PAM and password control at the `F33f`_`[Wayback Machine`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Wayback_Machine]`_`f (archived August 19, 2013)

• Pluggable Authentication Modules for Linux

• Making the Most of Pluggable Authentication Modules (PAM)

• Oracle Solaris Administration: Security Services: Using PAM

`c`F0af`_`[↑ Back to top`#top]`_`f`a