Read secret from program.

I'd like to implement the Google Authenticator PAM module for sudo in my infrastructure, but the lack of a simple method to store the secrets for users on a central location (LDAP, Galera, etc) makes it a non-starter when you have 1000's of systems.

I've been looking over the various issues and see where it's been requested a few times to be able to read a secret for a given user from LDAP, MySQL, etc. The general answer from the developers has been it's too complicated to implement such a feature and they do want to not get tied into the specific details of LDAP, MySQL, etc. Which I understand.

Therefor, I am requesting a more generic ability, to read the "secret" from a command pipe. I think that is a better way of doing it. This is exactly what SSHd does for reading public keys, using the AuthorizedKeysCommand directive:

- Specifies a program to be used to look up the user's public keys. The program must be owned by root,
not writable by group or others and specified by an absolute path. Arguments to AuthorizedKeysCommand
accept the tokens described in the TOKENS section. If no arguments are specified then the username of
the target user is used.

If the Authenticator PAM module supported a similar capability (i.e. serectcmd=) to execute a command to return the secret key (instead of just reading it from a file), then any number of helper programs could be written by 3rd parties to allow it to pull the secret from LDAP, MySQL, PostGres, HTTPS, etc based entirely on the specific environment it was needed in.

Anyway, I think this would be an excellent enhancement to the PAM authenticator module and solve many of the issues related to deploying at scale.