libpam

libpam is the runtime library that provides the application programming interface (API) for Pluggable Authentication Modules (PAM) on Unix-like systems. It offers a uniform interface that applications use to perform authentication, account management, session management, and password management through modular components known as PAM modules.

An application starts a PAM transaction by calling pam_start with a service name and a user, then invokes pam_authenticate to verify the user, pam_acct_mgt to enforce account policies, pam_open_session and pam_close_session to manage user sessions, and pam_end to finish the transaction. The library consults a stack of modules configured for the target service and applies their results according to control flags (required, sufficient, etc.).

Configuration occurs through PAM configuration files located in /etc/pam.d (and historically /etc/pam.conf). These files specify the modules to be invoked, their order, and the control flags that determine how module results influence success or failure. Modules implement actual methods such as password authentication, token or biometric checks, and account or session restrictions. The library uses a conversation function to prompt users for credentials or other input when needed.

libpam is part of Linux-PAM and is used by many system components and services, including login, su, sudo, passwd, and graphical login managers. It is designed to be portable across Unix-like systems and is provided by many distributions.

Conceptually, PAM and libpam aim to decouple authentication mechanisms from applications, allowing administrators to change authentication methods without recompiling software. The library handles the negotiation between the application and the modules, coordinating prompts and responses as required by the configured stack.