How PAM Works?

PAM defines a protocol and an API that should be followed by both the application programmer, and the PAM module writers.

The server is not linked with the PAM modules directly - they are loaded on demand, according to the configuration specified for the given server. The loading is done through usage of the PAM library that the server is linked with.

Each server has a (hopefully) unique identifier, that specifies which configuration file will be used to determine its authentication behavior.

The PAM library reads the configuration file of the server, and tries out the modules written in it, one by one, until an 'accept' or a 'reject' is granted by one of these modules.