Once all of the modules in the stack have executed, authentication success or failure is determined by combining the results of all the required modules. Optional modules are used only when no definitive decision is reached by the required modules. When a user enters an su command, three modules are used to determine whether execution should be allowed. The module returns success if the correct password is entered, and returns failure otherwise. Finally, the session entry generates a syslog entry for this invocation of su.
Many PAM modules are highly configurable.