pushinbr/pam-native-auth

Secure sessions, encrypted credential vaults and OAuth 2.1/PKCE primitives for PAM Native.

Maintainers

Package info

github.com/push-in/pam-native-auth

Type:pam-native-plugin

pkg:composer/pushinbr/pam-native-auth

Transparency log

Statistics

Installs: 3

Dependents: 0

Suggesters: 0

Stars: 0

Open Issues: 0

Security

Advisories: 0

Aikido package health analysis

v0.1.0 2026-08-01 03:52 UTC

Requires

BUSL-1.1 c569ae91bbd8f546cd62e4f4c2d5ea80a9e3c0ab

Published on Packagist.org on 2026-08-01 06:05 UTC

This package is auto-updated.

Last update: 2026-08-01 06:08:45 UTC

README

Production authentication foundations for PAM Native applications. Secrets are encrypted by Android Keystore or stored by Apple Keychain instead of being written to PHP files, preferences, or application databases.

composer require pushinbr/pam-native-auth
pam mobile codegen
pam mobile ios:prepare
use Pam\Native\Auth\AuthVault;
use Pam\Native\Auth\Pkce;

$pkce = Pkce::generate(); // Send $pkce->challenge to your OAuth 2.1 authorization server.

(new AuthVault())->store('session.refresh-token', $refreshToken, function ($state, $error): void {
    // AuthOperationState is an integer-backed enum.
});

The vault uses AES-256-GCM with a non-exportable Android Keystore key. On Apple platforms it uses a generic-password Keychain item and defaults to WhenUnlockedThisDeviceOnly. PKCE uses SHA-256 (S256) and a cryptographically random verifier.

Do not store user passwords. Store short-lived sessions or refresh tokens, rotate them server-side, and delete the local credential on logout or revocation.

Platform support

  • Android 8.0+ (API 26): Android Keystore + AES-GCM.
  • iOS 15+: Security.framework Keychain.
  • PAM Native 0.6.x plugin protocol 1.

Passkeys and interactive OAuth authorization are deliberately separate from the vault because they require an app presentation context, associated domains, and server-side challenge verification. Those flows will be added only with end-to-end app lifecycle support.