Pluggable Authentication Module with Self Service+
- Last UpdatedOct 6, 2025
- 2 minute read
The Pluggable Authentication Module (PAM) is an authentication tool that allows users to use their network password with the sudo command rather than their local password. PAM is included in all installations of Self Service+ (formerly the Jamf Connect menu bar app) and stored on computers in the following location:
/usr/local/lib/pam/pam_saml.so.2
- Enter edit mode and do one of the following:Note:
A warning may display when attempting to edit a read-only file. Continue to edit the file, and then refer to step 5 to save your changes.
- To allow (but not require) network authentication for
sudocommands, add the following entry:auth sufficient pam_saml.so
- To require network authentication for
sudocommands, do the following:Add the following entry:
auth required pam_saml.soComment out the
pam_opendirectory.soentry by adding a pound symbol (#) at the beginning of that line.
- To allow (but not require) network authentication for
The PAM module should now prompt users to authenticate with your IdP any time a sudo command is attempted.
If the Pluggable Authentication Module (PAM) is enabled, you can use the sudo command to authenticate with your cloud identity provider (IdP).
- In Terminal, execute any
sudocommand, such as the following:
Your IdP's login screen should display.sudo -s
- Enter your network username and password to authenticate.Note:Once authenticated, the
If you configured network authentication to be sufficient but not required, closing the login window will cause macOS to prompt you to enter your password in Terminal instead. If you configured network authentication to be required, closing the login window will cause authentication to fail.
sudocommand should successfully execute in Terminal.