3 ms·

The API for “Pluggable Authentication Modules” (PAM) seems to be earning its name. It’s an ideal adapter layer for adding interoperable authentication to any pr

The API for “Pluggable Authentication Modules” (PAM) seems to be earning its name. It’s an ideal adapter layer for adding interoperable authentication to any program. And since so many programs already consume it, it’s a natural target for new authentication providers to implement. If a backend can serialize its authentication model to users and groups, then it can give those lists to a program that consumes them through PAM to authenticate users and authorize actions. Thanks to open standards (really POSIX in this case), even a small program can immediately benefit from PAM authentication because it will work in any organizational environment, regardless of whatever over-engineered backend system (like LDAP or Kerberos) or SaaS (like Okta or O365) is providing the list of users and groups.

KMnO4 4y ago
I was really hoping the article would have explained a bit about PAM. Any high school English teacher can Google instructions for enabling sudo with Touch ID, but I’ve come to expect HN posts to have a higher pedigree.
- chatmasta 4y ago
  Yes, I thought the same while I was googling to ensure my comment wouldn’t betray the fact that I’ve never actually implemented PAM myself. :D (I’ve certainly benefitted from it though!) When exploring a technology I like to search GitHub for it, since that should surface a healthy sample of code that uses it. For instance the “pam” topic looks like a fun rabbit hole to click into, with a list of repositories demonstrating a wide array of use cases for PAM. [0] [0] https://github.com/topics/pam?o=desc&s=stars https://github.com/topics/pam?o=desc&s=stars
tedunangst 4y ago
What's the connection between PAM and POSIX?
- chatmasta 4y ago
  My impression is that PAM assumes it’s running in a Linux kernel with the typical POSIX users and permissions system. I could be misinformed though, I’ve never actually coded anything with it.
  - GekkePrutser 4y ago
    That's not entirely true. PAM exists on many systems, wiyh their own codebase. FreeBSD for example has its own build which definitely doesn't presume Linux. Not sure which one macOS' implementation is based on but considering its history I would bet on one of the BSDs.

KMnO4 4y ago

I was really hoping the article would have explained a bit about PAM. Any high school English teacher can Google instructions for enabling sudo with Touch ID, but I’ve come to expect HN posts to have a higher pedigree.

chatmasta 4y ago
Yes, I thought the same while I was googling to ensure my comment wouldn’t betray the fact that I’ve never actually implemented PAM myself. :D (I’ve certainly benefitted from it though!) When exploring a technology I like to search GitHub for it, since that should surface a healthy sample of code that uses it. For instance the “pam” topic looks like a fun rabbit hole to click into, with a list of repositories demonstrating a wide array of use cases for PAM. [0] [0] https://github.com/topics/pam?o=desc&s=stars https://github.com/topics/pam?o=desc&s=stars

tedunangst 4y ago

What's the connection between PAM and POSIX?

chatmasta 4y ago
My impression is that PAM assumes it’s running in a Linux kernel with the typical POSIX users and permissions system. I could be misinformed though, I’ve never actually coded anything with it.
- GekkePrutser 4y ago
  That's not entirely true. PAM exists on many systems, wiyh their own codebase. FreeBSD for example has its own build which definitely doesn't presume Linux. Not sure which one macOS' implementation is based on but considering its history I would bet on one of the BSDs.