Pluggable Authentication Module for TouchID enabled MacBooks
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.

Pluggable Authentication Module using Touch-ID

This module allows us to authenticate services via touch-id using Apple's LocalAuthentication API. I am using the module to authenticate sudo as it's something we run frequently. The module can be dropped in to authenticate any other PAM enabled service as well.


Compile this module as the user who has touchid active. Otherwise manually edit the user id's inside the .m file.

make all


The compiled module must be installed to /usr/lib/pam which is a system directory protected by System Integrity Protection (SIP). To install the module you have to disable this (no worries, it can be enabled later).

Reboot while holding Command-R, go into the recovery mode and spawn a new shell. In the shell run

csrutil disable

Reboot, copy the module over by doing sudo cp /usr/lib/pam/

Next, add this line to the top of /etc/pam.d/sudo

auth       sufficient

This also allows fallback to standard password authentication if your finger fails.

Reboot back into recovery to enable SIP again

csrutil enable


Here's what shows on the touchbar when you try to sudo with the module installed

Touchbar screenshot