It appears that the best PAM module for ruby is "rpam". However this module hard codes the service name "rpam" when calling pam_start which seems to be denied by default on at least RHEL. I can get rpam to work by hacking the source to change the hardcoded service name to something present in /etc/pam.d.
Do people normally reconfigure PAM to make use of rpam? Is there a better PAM module out there? (It needs to work with Ruby 1.9.) Is there something obvious I'm missing?