As a PAM module, I want to authenticate using an OAuth2 token instead of password

[guimard]

User Story

As the PAM module,
I want to accept an OAuth2 token as the "password",
So that desktop SSO can work without users entering their real password.

Acceptance Criteria

• New config option token_mode=true
• When enabled, treat password as access token
• Validate token with LLNG /pam/authorize
• Extract user info from token validation response
• Works with existing user creation flow

Technical Details

Config

auth required pam_llng.so token_mode=true

Flow

pam_sm_authenticate():
    1. Get "password" from PAM
    2. If token_mode:
        - POST /pam/authorize with token as bearer
        - Validate response
        - Extract user info
    3. Else:
        - Normal password authentication

PAM Config for LightDM

# /etc/pam.d/lightdm
auth       required     pam_llng.so token_mode=true
account    required     pam_llng.so
session    required     pam_llng.so create_user=true
session    required     pam_unix.so

Files to Modify

• include/config.h: add token_mode option
• src/config.c: parse option
• src/pam_llng.c: token validation logic in pam_sm_authenticate

Component

Repo: llng-pam-module (C)