This article needs additional citations for verification. (May 2011) |
Pluggable authentication modules (PAM) are a mechanism to integrate multiple low-level authentication schemes into a high-level application programming interface (API). It allows programs that rely on authentication to be written independent of the underlying authentication scheme. PAM was first proposed by Sun Microsystems in an Open Software Foundation Request for Comments (RFC) 86.0 dated October 1995. It was adopted as the authentication framework of the Common Desktop Environment. As a stand-alone open source infrastructure, PAM first appeared in Red Hat Linux 3.0.4 in August 1996. PAM is currently supported in the AIX operating system, DragonFly BSD,[1] FreeBSD, HP-UX, Linux, Mac OS X, NetBSD and Solaris. PAM was later standardized as part of the X/Open UNIX standardization process, resulting in the X/Open Single Sign-on (XSSO) standard.
The XSSO standard differs from both the original RFC, and from the Linux and Sun APIs — from most other implementations. Also, they are not implemented similarly. For these and other reasons, OpenBSD has chosen to adopt BSD Authentication, which is an alternative authentication framework, originally from BSD/OS.
Criticisms of PAM
Despite PAM being part of the X/Open Single Sign-on (XSSO) standard, PAM on its own cannot implement Kerberos, the most common type of SSO used in Unix environments.
Due to limits of the PAM API, it is not possible for a PAM module to request a Kerberos service ticket from a Kerberos Key Distribution Center (KDC), allowing the user to utilize the application without re-authenticating. pam_krb5 only fetches ticket granting tickets, which involves prompting the user for credentials and are only used for initial login in an SSO environment. To fetch a service ticket for a particular application, and not prompt the user to enter credentials again, that application must be specifically coded to support Kerberos, as pam_krb5 cannot itself get service tickets, although there are versions of PAM-KRB5 that are attempting to work around the issue.[2]
See also
References
External links
- The original PAM RFC
- Sun PAM page
- Java-PAM bridge
- OCaml-PAM bridge
- PAM and password control
- Pluggable Authentication Modules for Linux
- Making the Most of Pluggable Authentication Modules (PAM)
 | This security software article is a stub. You can help Wikipedia by expanding it. |