Appendix D. Solaris OE 9 PAM Architecture

This section describes the PAM application programming interface (API) and the PAM service provider interface (SPI). Also included are procedures on how to effectively write PAM modules when using the Solaris 9 OE. Before we discuss the PAM API and SPI, let us take a brief look at the PAM components :

• PAM API ( pam(3PAM) ) used by applications to perform authentication and authentication token (password) changes.

• PAM framework used to export the API.

• PAM SPI ( pam_sm(3PAM) ) used by the PAM framework to call PAM Service Modules.

• PAM service modules ( pam_*(5) ) used to export the PAM SPI.

By writing these PAM service modules, it is possible to extend the capability of the Solaris 9 OE authentication mechanisms in a number of different ways. The PAM interface in the Solaris 9 OE provides a set of APIs that can be used by third-party applications to extend authentication capabilities. By using the PAM layer, applications authenticate to the system without worrying about what authentication method has been chosen by the system administrator for any given client. For example, it is possible for a system administrator to prevent users from choosing new passwords that resemble their old password.

A PAM module is a shared object that is developed and written using the C programming language. The module is dynamically selected based on the contents of the pam.conf(4) configuration file. This is an extremely efficient mechanism that enables the selection of the most appropriate authentication mechanism for a particular environmentwithout sacrificing functionality or the need to depend on third-party or unsupported software.

Developing a PAM module is not as difficult as you might think. The PAM API has a rich set of features, and is fairly intuitive to learn and use. Online documentation is also available (see http://docs.sun.com).

This section addresses the following topics:

• Details of the PAM API

• Details of the PAM SPI

• Details on how to write a PAM service module

• Details on how to test a PAM service module