I may be wrong, but... If you really can't install PAM on some systems, I think making a library that masquerades as PAM might be the easiest way. The interface PAM exports to PAM clients is not very complicated, so making a pretend PAM would be a lot easier than making PAM from scratch. make your pretend PAM connect directly to your authentication server and you're done.
- Ben
