Login PAM interaction suspect

  I'm not sure where to discuss this, but this seemed like a venue  
that would attract some knowledgeable feedback.

  I am designing a PAM module to serve as a backup authentication  
mechanism for a device when it has lost network connectivity to it's  
LDAP server.  There is no local password containing file on the  
system. The credential used has OTP-ish properties and encodes a  
privilege level as well.
  Upon successful authentication, I planned on the module fabricating  
a one line passwd file that would be timestamped and deleted past usage.
  A helper nsslib function will deal with fronting the "user"  
information to login and the system.

  I was wondering which api service to put the logic the builds the  
authenticated user information.
  I was thinking that pam_setcred() would be appropriate.

  But then I decided to read the login code and my head exploded.   
Below is a simplified snippet of the login code we have in our distro.  
  I looked at the current code on kernel.org, and it seems to be  
rewritten and refactored into multiple subroutines, but still has the  
same logic flow.

---<snippet of login.c>----
     /*
      * Grab the user information out of the password file for future usage
      * First get the username that we are actually using, though.
      */
     retcode = pam_get_item(pamh, PAM_USER, (const void **) &username);