Ssh certainly have built in auth - i think usepam = no is still the default? Ssh certificates certainly "reinvent" auth - but not really in a bad way. Kerberos

Ssh certainly have built in auth - i think usepam = no is still the default? Ssh certificates certainly "reinvent" auth - but not really in a bad way. Kerberos should also be quite possible without Pam. But either way, you need some trusted code with privileges to grant privileges (eg an suid binary).