Python PAM

2.0.2 · active · verified Sat Apr 11

python-pam is a Python module that provides an interface to the Pluggable Authentication Modules (PAM) system on Unix-like operating systems using ctypes. It enables Python applications to perform user authentication tasks by leveraging the underlying system's PAM configuration. The current version is 2.0.2. Releases are primarily driven by bug fixes and compatibility updates.

Warnings

breaking The `authenticate()` method's return type changed from a boolean to a PAM constant in version 2.0.0, and then reverted to a boolean in 2.0.2. Code expecting a boolean in 2.0.0 would have broken. Always check the return value against `True`/`False` or the specific PAM constant for 2.0.0 if targeting that version.
Fix: Ensure your code checks for `True` or `False` return values from `authenticate()`. If specifically targeting 2.0.0, verify against the PAM constant, otherwise boolean is standard in 2.0.2+.
gotcha The library adheres to standard PAM privilege rules: if running as root (or with privileged access), you can check any account's password. If not running as root, you can generally only check the validity of the username running the tool.
Fix: Design your application with appropriate privilege separation. For authenticating multiple users in a non-privileged context, consider an authentication stack like SSSD on Linux.
deprecated While Python 2 support was intentionally left in for version 2.0.0, the project README explicitly states that Python 2 support is deprecated.
Fix: Migrate any Python 2 usage to Python 3 as future support is not guaranteed and actively discouraged.
gotcha The functionality of `python-pam` is entirely dependent on the underlying system's PAM configuration (e.g., files in `/etc/pam.d/`). Misconfiguration of PAM on the host system will lead to authentication failures or unexpected behavior within your Python application.
Fix: Familiarize yourself with PAM configuration on your target system. Ensure the relevant PAM service (`/etc/pam.d/system-auth` or a custom service) is correctly configured for the desired authentication methods.
gotcha This library is designed for Unix-like operating systems (specifically Linux) and does not support Windows.
Fix: Deploy applications using `python-pam` only on Linux or other compatible Unix-like systems. For Windows authentication, consider alternative libraries or methods.

Install

pip install python-pam Install with pip

Imports

pam
```
import pam
```
The primary interface is directly via the 'pam' module.

Quickstart

Initializes the PAM authentication object and attempts to authenticate a user with provided credentials. The `authenticate()` method returns `True` or `False`, and additional details are available in `p.code` and `p.reason`.

import pam
import os

p = pam.authenticate()

# For demonstration, use environment variables or default values.
# On a real system, you would get these from user input.
username = os.environ.get('PAM_TEST_USERNAME', 'testuser')
password = os.environ.get('PAM_TEST_PASSWORD', 'testpassword')

# Note: For successful authentication, 'testuser' and 'testpassword'
# must be valid credentials on the system where this code runs,
# and the PAM configuration must allow 'python-pam' to authenticate.
if p.authenticate(username, password):
    print(f"Authentication successful for {username}. Code: {p.code}, Reason: {p.reason}")
else:
    print(f"Authentication failed for {username}. Code: {p.code}, Reason: {p.reason}")

view raw JSON →