optional auth to a separate library to avoid complex configuration
of pam and ldap prerequisites in default case.