I think that the PAM module with the most potential is the one in the Linux-PAM repository on sourceforge. I'm not sure it's really usable in its current form. I'd also consider using the native Solaris module, but putting your authorization checks in an account phase module you write yourself.