It appears that the best PAM module for ruby is "rpam". However this module hard codes the service name "rpam" when calling pam_start which seems to be denied by default on at least RHEL. I can get rpam to work by hacking the source to change the hardcoded service name to something present in /etc/pam.d.
Do people normally reconfigure PAM to make use of rpam? Is there a better PAM module out there? (It needs to work with Ruby 1.9.) Is there something obvious I'm missing?
Having researched more, it looks to me like people normally add an rpam file to /etc/pam.d/.