---
name: "pam_localauthentication"
section: "8"
platform: "macos"
package: "pam_modules"
version: "217.100.6"
release: "macOS 26.5"
platforms: ["macos"]
url: "https://new.carta.tech/pam_localauthentication"
---

# pam\_localauthentication(8)

LocalAuthentication PAM module

## NAME

**pam\_localauthentication** – LocalAuthentication PAM module

## SYNOPSIS

\[*service-name*\] *function-class* *control-flag* pam\_localauthentication \[*options*\]

## DESCRIPTION

The LocalAuthentication PAM module supports the authentication function class, *function-class* parameter is “auth”.

### The LocalAuthentication Authentication Module

The LocalAuthentication authentication module permits or denies authentication based on LAContext policy evaluation.

The module will try to create LAContext from the externalized blob returned by previous invocation of “LAContext.externalizedContext”. The blob will be queried by [pam\_get\_data(3)](/pam_get_data/3.md) as data named “token\_la”.

When the LAContext instance is successfully created, the module will try to evaluate “LAPolicyDeviceOwnerAuthenticationWithBiometrics” on it with user interaction disabled. The expectation is that the policy was already successfully evaluated before. If so, then the authentication performed by this module will succeed as well.

The following options may be passed to this authentication module:

- **continuityunlock**

  Use the alternative LAContext for AppleWatch unlock. The LAContext blob will be queried by [pam\_get\_data(3)](/pam_get_data/3.md) as data named “token\_lacont” and the policy evaluated will be “LAPolicyContinuityUnlock”.

## SEE ALSO

[mbr\_check\_membership(3)](/mbr_check_membership/3.md), [pam.conf(5)](/pam.conf/5.md), [pam(8)](/pam/8.md), pwpolicy(8), [pam\_get\_data(3)](/pam_get_data/3.md)