Pam NIS authentication

Hi,

I'm trying to configure Postgres to authenticate NIS users through pam.

Here is my setup:

Server version:
PostgreSQL 15.2 on x86_64-redhat-linux-gnu, compiled by gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-18), 64-bit

Relevant pg_hba lines:
host all psql all md5
host all all all pam

PAM:
/etc/pam.d/postgresql
#%PAM-1.0
auth include password-auth
account include password-auth

/etc/pam.d/password-auth
# Generated by authselect on Wed Jan 31 12:48:13 2024
# Do not modify this file manually.

auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_unix.so nullok
auth required pam_deny.so

account required pam_unix.so broken_shadow

password requisite pam_pwquality.so local_users_only
password sufficient pam_unix.so sha512 shadow nullok use_authtok nis
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so

Pam service seems to be okay, ie if I provide the correct pass, it lets me through with both local and NIS accounts:
% pamtester -v postgresql <localuser> authenticate
pamtester: invoking pam_start(postgresql, <localuser>, ...)
pamtester: performing operation - authenticate
Password:
pamtester: successfully authenticated

% pamtester -v postgresql <nisuser> authenticate
pamtester: invoking pam_start(postgresql, <nisuser>, ...)
pamtester: performing operation - authenticate
Password:
pamtester: successfully authenticated

Users exist in Postgres with login permission, required NIS daemons are up and running, tools like ypwhich or ypcat are working fine.
But when I try to connect to Postgres server using NIS account, authentication fails:
psql: error: connection to server at "<hostname>" (10.65.31.25), port 5432 failed: FATAL: PAM authentication failed for user "<nisuser>"

Server logs:
[52] DEBUG: forked new backend, pid=564 socket=10
[564] DEBUG: InitPostgres
[564] DEBUG: my backend ID is 3
[564] DEBUG: StartTransaction(1) name: unnamed; blockState: DEFAULT; state: INPROGRESS, xid/subid/cid: 0/1/0
[564] DEBUG: shmem_exit(0): 4 before_shmem_exit callbacks to make
[564] DEBUG: shmem_exit(0): 6 on_shmem_exit callbacks to make
[564] DEBUG: proc_exit(0): 2 callbacks to make
[564] DEBUG: exit(0)
[564] DEBUG: shmem_exit(-1): 0 before_shmem_exit callbacks to make
[564] DEBUG: shmem_exit(-1): 0 on_shmem_exit callbacks to make
[564] DEBUG: proc_exit(-1): 0 callbacks to make
[52] DEBUG: reaping dead processes
[52] DEBUG: server process (PID 564) exited with exit code 0
[52] DEBUG: forked new backend, pid=566 socket=10
[566] DEBUG: InitPostgres
[566] DEBUG: my backend ID is 3
[566] DEBUG: StartTransaction(1) name: unnamed; blockState: DEFAULT; state: INPROGRESS, xid/subid/cid: 0/1/0
[566] DEBUG: received password packet
[566] LOG: pam_authenticate failed: Authentication failure
[566] FATAL: PAM authentication failed for user "<nisuser>"
[566] DETAIL: Connection matched pg_hba.conf line 105: "host all all all pam"
[566] DEBUG: shmem_exit(1): 4 before_shmem_exit callbacks to make
[566] DEBUG: shmem_exit(1): 6 on_shmem_exit callbacks to make
[566] DEBUG: proc_exit(1): 2 callbacks to make
[566] DEBUG: exit(1)
[566] DEBUG: shmem_exit(-1): 0 before_shmem_exit callbacks to make
[566] DEBUG: shmem_exit(-1): 0 on_shmem_exit callbacks to make
[566] DEBUG: proc_exit(-1): 0 callbacks to make
[52] DEBUG: reaping dead processes
[52] DEBUG: server process (PID 566) exited with exit code 1

Secure log:
<nisuser>[564]: psql 10.65.31.25(39990) authentication: pam_unix(postgresql:auth): username [<nisuser>] obtained
<nisuser>[564]: psql 10.65.31.25(39990) authentication: pam_unix(postgresql:auth): conversation failed
<nisuser>[564]: psql 10.65.31.25(39990) authentication: pam_unix(postgresql:auth): auth could not identify password for [<nisuser>]
<nisuser>[566]: psql 10.65.31.25(40004) authentication: pam_unix(postgresql:auth): username [<nisuser>] obtained
<nisuser>[566]: psql 10.65.31.25(40004) authentication: pam_unix(postgresql:auth): check pass; user unknown
<nisuser>[566]: psql 10.65.31.25(40004) authentication: pam_unix(postgresql:auth): authentication failure; logname= uid=26 euid=26 tty= ruser= rhost=10.65.31.25

All of this works fine for 'local' Linux accounts.

Am I missing something?

thanks,

--
wbr,
Andrey