This is a bit of a work in progress, but it's a start at being able to do mechanism-agnostic initial credentials authentication: https://github.com/PADL/pam_gss -- Luke