Editing Pluggable Authentication Module (section)

==Criticisms==
Since most PAM implementations do not interface with remote clients themselves, PAM, on its own, cannot implement [[Kerberos (protocol)|Kerberos]], the most common type of [[Single sign-on|SSO]] used in Unix environments. This led to SSO's incorporation as the "primary authentication" portion of the would-be XSSO standard and the advent of technologies such as [[SPNEGO]] and [[Simple Authentication and Security Layer|SASL]]. This lack of functionality is also the reason [[Secure Shell|SSH]] does its own authentication mechanism negotiation.

In most PAM implementations, pam_krb5 only fetches [[Ticket Granting Ticket]]s, which involves prompting the user for credentials, and this is only used for the initial login in an SSO environment. To fetch a service ticket for a particular application, and not prompt the user to enter credentials again, that application must be specifically coded to support Kerberos. This is because pam_krb5 cannot itself get service tickets, although there are versions of PAM-KRB5 that are attempting to work around the issue.<ref>[http://www.eyrie.org/~eagle/software/pam-krb5/ PAM-KRB5]</ref>