diff --git a/.travis.yml b/.travis.yml
index 19156a46..ebaa7985 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ matrix:
         - gcc
 before_install:
 - eval "${MATRIX_EVAL}"
-- sudo apt-get install build-essential cmake libboost-all-dev libconfig++-dev libavcodec-dev libavutil-dev libavformat-dev ffmpeg libgraphicsmagick++1-dev libpstreams-dev libconfig++-dev libpstreams-dev libtag1-dev
+- sudo apt-get install build-essential cmake libboost-all-dev libconfig++-dev libavcodec-dev libavutil-dev libavformat-dev ffmpeg libgraphicsmagick++1-dev libpstreams-dev libconfig++-dev libpstreams-dev libtag1-dev libpam0g-dev
 - git clone https://github.com/emweb/wt.git wt
 - pushd wt;
 - git checkout 4.2.1
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1faefee5..8d84e7d3 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -2,7 +2,6 @@ cmake_minimum_required(VERSION 3.12)
 
 project(lms)
 
-
 set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${CMAKE_SOURCE_DIR}/cmake/modules/")
 
 set(CMAKE_CXX_STANDARD 17)
@@ -11,12 +10,18 @@ set(CMAKE_CXX_STANDARD_REQUIRED True)
 include(CTest)
 find_package(PkgConfig REQUIRED)
 find_package(Filesystem REQUIRED)
+find_package(FFMPEGAV REQUIRED)
+find_package(Taglib REQUIRED)
+find_package(Boost REQUIRED COMPONENTS system)
+find_package(PStreams REQUIRED)
+find_package(PAM)
 pkg_check_modules(GRAPHICSMAGICKXX REQUIRED GraphicsMagick++)
 
 add_subdirectory(src)
 
 install(DIRECTORY approot DESTINATION share/lms)
 install(DIRECTORY docroot DESTINATION share/lms)
-install(FILES systemd/default.service DESTINATION share/lms)
+install(FILES conf/systemd/default.service DESTINATION share/lms)
+install(FILES conf/pam/lms DESTINATION share/lms)
 install(FILES conf/lms.conf DESTINATION share/lms)
 
diff --git a/README.md b/README.md
index 2d1b24a0..d8e1773e 100644
--- a/README.md
+++ b/README.md
@@ -90,9 +90,11 @@ __Notes__:
 * a C++17 compiler is needed
 * ffmpeg version 4 minimum is required
 ```sh
-apt-get install g++ cmake libboost-system-dev libavutil-dev libavformat-dev libgraphicsmagick++1-dev libconfig++-dev libpstreams-dev ffmpeg libtag1-dev
+apt-get install g++ cmake libboost-system-dev libavutil-dev libavformat-dev libgraphicsmagick++1-dev libconfig++-dev libpstreams-dev ffmpeg libtag1-dev libpam0g-dev
 ```
 
+__Note__: package libpam0g-dev is optional (only for using PAM authentication)
+
 You also need _Wt4_, which is not packaged yet on _Debian_. See [installation instructions](https://www.webtoolkit.eu/wt/doc/reference/html/InstallationUnix.html).</br>
 No optional requirement is needed, except openSSL if you plan not to deploy behind a reverse proxy (which is not recommended).
 
diff --git a/approot/admin-user.xml b/approot/admin-user.xml
index c3adc97a..80a97d25 100644
--- a/approot/admin-user.xml
+++ b/approot/admin-user.xml
@@ -30,6 +30,15 @@
 						</div>
 					</div>
 					${</if-has-login>}
+					<div class="form-group">
+						<label class="control-label col-lg-3"  for="${id:auth-mode}">
+							${tr:Lms.Admin.User.auth-mode}
+						</label>
+						<div class="col-lg-9">
+							${auth-mode}
+							${auth-mode-info class="help-block"}
+						</div>
+					</div>
 					<div class="form-group">
 						<label class="control-label col-lg-3"  for="${id:password}">
 							${tr:Lms.password-new}
diff --git a/approot/messages.xml b/approot/messages.xml
index 9c63aee0..45e0280f 100644
--- a/approot/messages.xml
+++ b/approot/messages.xml
@@ -16,6 +16,7 @@
 <message id="Lms.password-bad-login-combination">Bad login / password combination</message>
 <message id="Lms.password-client-throttled">Login throttled, please try again later</message>
 <message id="Lms.password-confirm">Confirm password</message>
+<message id="Lms.password-must-not-be-empty">Password must not be empty</message>
 <message id="Lms.password-new">New password</message>
 <message id="Lms.password-old">Old password</message>
 <message id="Lms.password-too-weak">Password too weak</message>
@@ -81,6 +82,9 @@
 <message id="Lms.Admin.Users.menu-users"><i class="fa fa-fw fa-users" aria-hidden="true"></i> Users</message>
 
 <!--User-->
+<message id="Lms.Admin.User.auth-mode">Authentication mode</message>
+<message id="Lms.Admin.User.auth-mode.internal">Internal</message>
+<message id="Lms.Admin.User.auth-mode.pam">PAM</message>
 <message id="Lms.Admin.User.demo-account">Demo account</message>
 <message id="Lms.Admin.User.demo-account-already-exists">Demo account already exists!</message>
 <message id="Lms.Admin.User.demo-password-invalid">Demo password must be the login name!</message>
diff --git a/approot/messages_fr.xml b/approot/messages_fr.xml
index 7b92c05b..e9dc699a 100644
--- a/approot/messages_fr.xml
+++ b/approot/messages_fr.xml
@@ -16,6 +16,7 @@
 <message id="Lms.password-bad-login-combination">Mauvaise combinaison login / mot de passe</message>
 <message id="Lms.password-client-throttled">Trop de tentatives de connexion, veuillez réessayer plus tard</message>
 <message id="Lms.password-confirm">Confirmation du mot de passe</message>
+<message id="Lms.password-must-not-be-empty">Le mot de passe ne doit pas être vide</message>
 <message id="Lms.password-new">Nouveau mot de passe</message>
 <message id="Lms.password-old">Ancien mot de passe</message>
 <message id="Lms.password-too-weak">Mot de passe trop faible</message>
@@ -81,6 +82,9 @@
 <message id="Lms.Admin.Users.menu-users"><i class="fa fa-fw fa-users" aria-hidden="true"></i> Utilisateurs</message>
 
 <!--User-->
+<message id="Lms.Admin.User.auth-mode">Mode d'authentification</message>
+<message id="Lms.Admin.User.auth-mode.internal">Interne</message>
+<message id="Lms.Admin.User.auth-mode.pam">PAM</message>
 <message id="Lms.Admin.User.demo-account">Compte de démonstration</message>
 <message id="Lms.Admin.User.demo-account-already-exists">Le compte de démonstration existe déjà !</message>
 <message id="Lms.Admin.User.demo-password-invalid">Le password doit être égal au login !</message>
diff --git a/cmake/modules/FindFFMPEGAV.cmake b/cmake/modules/FindFFMPEGAV.cmake
new file mode 100644
index 00000000..896c10b4
--- /dev/null
+++ b/cmake/modules/FindFFMPEGAV.cmake
@@ -0,0 +1,23 @@
+# Quick and dirty av* includes discoverer
+
+find_path(AVCODEC_INCLUDE_DIR NAMES libavcodec/avcodec.h PATH_SUFFIXES ffmpeg)
+find_library(AVCODEC_LIBRARY avcodec)
+
+find_path(AVFORMAT_INCLUDE_DIR NAMES libavformat/avformat.h PATH_SUFFIXES ffmpeg)
+find_library(AVFORMAT_LIBRARY avformat)
+
+find_path(AVUTIL_INCLUDE_DIR NAMES libavutil/avutil.h PATH_SUFFIXES ffmpeg)
+find_library(AVUTIL_LIBRARY avutil)
+
+include(FindPackageHandleStandardArgs)
+
+FIND_PACKAGE_HANDLE_STANDARD_ARGS(
+        FFMPEGAV
+        FOUND_VAR FFMPEGAV_FOUND
+        REQUIRED_VARS AVUTIL_LIBRARY AVFORMAT_LIBRARY
+)
+
+mark_as_advanced(AVFORMAT_LIBRARY)
+mark_as_advanced(AVUTIL_LIBRARY)
+
+
diff --git a/cmake/modules/FindPAM.cmake b/cmake/modules/FindPAM.cmake
new file mode 100644
index 00000000..08c86def
--- /dev/null
+++ b/cmake/modules/FindPAM.cmake
@@ -0,0 +1,73 @@
+# From http://code.google.com/p/pam-face-authentication/source/browse/branches/pam_face_authentication/cmake/modules/FindPAM.cmake?r=336
+
+# - Try to find the PAM libraries
+# Once done this will define
+#
+#  PAM_FOUND - system has pam
+#  PAM_INCLUDE_DIR - the pam include directory
+#  PAM_LIBRARIES - libpam library
+
+if (PAM_INCLUDE_DIR AND PAM_LIBRARY)
+	# Already in cache, be silent
+	set(PAM_FIND_QUIETLY TRUE)
+endif (PAM_INCLUDE_DIR AND PAM_LIBRARY)
+
+find_path(PAM_INCLUDE_DIR NAMES security/pam_appl.h pam/pam_appl.h)
+find_library(PAM_LIBRARY pam)
+find_library(DL_LIBRARY dl)
+
+if (PAM_INCLUDE_DIR AND PAM_LIBRARY)
+	set(PAM_FOUND TRUE)
+	if (DL_LIBRARY)
+		set(PAM_LIBRARIES ${PAM_LIBRARY} ${DL_LIBRARY})
+	else (DL_LIBRARY)
+		set(PAM_LIBRARIES ${PAM_LIBRARY})
+	endif (DL_LIBRARY)
+
+	if (EXISTS ${PAM_INCLUDE_DIR}/pam/pam_appl.h)
+		# darwin claims to be something special
+		set(HAVE_PAM_PAM_APPL_H 1)
+	endif (EXISTS ${PAM_INCLUDE_DIR}/pam/pam_appl.h)
+
+	if (NOT DEFINED PAM_MESSAGE_CONST)
+		include(CheckCXXSourceCompiles)
+		# XXX does this work with plain c?
+		check_cxx_source_compiles("
+#if ${HAVE_PAM_PAM_APPL_H}+0
+# include <pam/pam_appl.h>
+#else
+# include <security/pam_appl.h>
+#endif
+static int PAM_conv(
+	int num_msg,
+	const struct pam_message **msg, /* this is the culprit */
+	struct pam_response **resp,
+	void *ctx)
+{
+	return 0;
+}
+int main(void)
+{
+	struct pam_conv PAM_conversation = {
+		&PAM_conv, /* this bombs out if the above does not match */
+		0
+	};
+	return 0;
+}
+" PAM_MESSAGE_CONST)
+	endif (NOT DEFINED PAM_MESSAGE_CONST)
+	set(PAM_MESSAGE_CONST ${PAM_MESSAGE_CONST} CACHE BOOL "PAM expects a conversation function with const pam_message")
+
+endif (PAM_INCLUDE_DIR AND PAM_LIBRARY)
+
+if (PAM_FOUND)
+	if (NOT PAM_FIND_QUIETLY)
+		message(STATUS "Found PAM: ${PAM_LIBRARIES}")
+	endif (NOT PAM_FIND_QUIETLY)
+else (PAM_FOUND)
+	if (PAM_FIND_REQUIRED)
+		message(FATAL_ERROR "PAM was not found")
+	endif(PAM_FIND_REQUIRED)
+endif (PAM_FOUND)
+
+mark_as_advanced(PAM_INCLUDE_DIR PAM_LIBRARY DL_LIBRARY PAM_MESSAGE_CONST) 
diff --git a/cmake/modules/FindPStreams.cmake b/cmake/modules/FindPStreams.cmake
new file mode 100644
index 00000000..bff205cd
--- /dev/null
+++ b/cmake/modules/FindPStreams.cmake
@@ -0,0 +1,17 @@
+# If already in cache, be silent
+if(PSTREAMS_INCLUDE_DIRS)
+  set (PSTREAMS_FIND_QUIETLY TRUE)
+endif()
+
+FIND_PATH(PSTREAMS_INCLUDE_DIR NAMES pstream.h
+          PATH_SUFFIXES pstreams
+          HINTS ${PSTREAMS_ROOT}/include $ENV{PSTREAMS_ROOT})
+
+set(PSTREAMS_INCLUDE_DIRS ${PSTREAMS_INCLUDE_DIR})
+
+# Handle the QUIETLY and REQUIRED arguments and set PSTREAMS_FOUND to TRUE if
+# all listed variables are TRUE.
+INCLUDE(FindPackageHandleStandardArgs)
+FIND_PACKAGE_HANDLE_STANDARD_ARGS(Pstreams DEFAULT_MSG PSTREAMS_INCLUDE_DIRS)
+
+MARK_AS_ADVANCED(PSTREAMS_INCLUDE_DIRS)
diff --git a/cmake/modules/FindTaglib.cmake b/cmake/modules/FindTaglib.cmake
new file mode 100644
index 00000000..7c617918
--- /dev/null
+++ b/cmake/modules/FindTaglib.cmake
@@ -0,0 +1,87 @@
+# - Try to find the Taglib library
+# Once done this will define
+#
+#  TAGLIB_FOUND - system has the taglib library
+#  TAGLIB_CFLAGS - the taglib cflags
+#  TAGLIB_LIBRARIES - The libraries needed to use taglib
+
+# Copyright (c) 2006, Laurent Montel, <montel@kde.org>
+#
+# Redistribution and use is allowed according to the terms of the BSD license.
+# For details see the accompanying COPYING-CMAKE-SCRIPTS file.
+
+IF(TAGLIB_FOUND)
+	MESSAGE(STATUS "Using manually specified taglib locations")
+ELSE()
+
+	if(NOT TAGLIB_MIN_VERSION)
+	  set(TAGLIB_MIN_VERSION "1.6")
+	endif(NOT TAGLIB_MIN_VERSION)
+
+	if(NOT WIN32)
+		find_program(TAGLIBCONFIG_EXECUTABLE NAMES taglib-config PATHS
+		   ${BIN_INSTALL_DIR}
+		)
+	endif(NOT WIN32)
+
+	#reset vars
+	set(TAGLIB_LIBRARIES)
+	set(TAGLIB_CFLAGS)
+
+#	MESSAGE( STATUS "PATHS: ${PATHS}")
+	# if taglib-config has been found
+	if(TAGLIBCONFIG_EXECUTABLE)
+
+	  exec_program(${TAGLIBCONFIG_EXECUTABLE} ARGS --version RETURN_VALUE _return_VALUE OUTPUT_VARIABLE TAGLIB_VERSION)
+
+	  if(TAGLIB_VERSION VERSION_LESS "${TAGLIB_MIN_VERSION}")
+		 message(STATUS "TagLib version not found: version searched :${TAGLIB_MIN_VERSION}, found ${TAGLIB_VERSION}")
+		 set(TAGLIB_FOUND FALSE)
+	  else(TAGLIB_VERSION VERSION_LESS "${TAGLIB_MIN_VERSION}")
+
+		 exec_program(${TAGLIBCONFIG_EXECUTABLE} ARGS --libs RETURN_VALUE _return_VALUE OUTPUT_VARIABLE TAGLIB_LIBRARIES)
+
+		 exec_program(${TAGLIBCONFIG_EXECUTABLE} ARGS --cflags RETURN_VALUE _return_VALUE OUTPUT_VARIABLE TAGLIB_CFLAGS)
+
+		 if(TAGLIB_LIBRARIES AND TAGLIB_CFLAGS)
+			set(TAGLIB_FOUND TRUE)
+#			message(STATUS "Found taglib: ${TAGLIB_LIBRARIES}")
+		 endif(TAGLIB_LIBRARIES AND TAGLIB_CFLAGS)
+		 string(REGEX REPLACE " *-I" ";" TAGLIB_INCLUDES "${TAGLIB_CFLAGS}")
+	  endif(TAGLIB_VERSION VERSION_LESS "${TAGLIB_MIN_VERSION}")
+	  mark_as_advanced(TAGLIB_CFLAGS TAGLIB_LIBRARIES TAGLIB_INCLUDES)
+
+	else(TAGLIBCONFIG_EXECUTABLE)
+
+	  include(FindLibraryWithDebug)
+	  include(FindPackageHandleStandardArgs)
+
+	  find_path(TAGLIB_INCLUDES
+		NAMES
+		tag.h
+		PATH_SUFFIXES taglib
+		PATHS
+		${INCLUDE_INSTALL_DIR}
+	  )
+
+	  find_library_with_debug(TAGLIB_LIBRARIES
+		WIN32_DEBUG_POSTFIX d
+		NAMES tag
+		PATHS
+		${LIB_INSTALL_DIR}
+	  )
+	
+	  find_package_handle_standard_args(Taglib DEFAULT_MSG 
+										TAGLIB_INCLUDES TAGLIB_LIBRARIES)
+	endif(TAGLIBCONFIG_EXECUTABLE)
+ENDIF()
+
+if(TAGLIB_FOUND)
+  if(NOT Taglib_FIND_QUIETLY AND TAGLIBCONFIG_EXECUTABLE)
+    message(STATUS "Found TagLib: ${TAGLIB_LIBRARIES}")
+  endif(NOT Taglib_FIND_QUIETLY AND TAGLIBCONFIG_EXECUTABLE)
+else(TAGLIB_FOUND)
+  if(Taglib_FIND_REQUIRED)
+    message(FATAL_ERROR "Could not find Taglib")
+  endif(Taglib_FIND_REQUIRED)
+endif(TAGLIB_FOUND) 
diff --git a/conf/pam/lms b/conf/pam/lms
new file mode 100644
index 00000000..fa7ad812
--- /dev/null
+++ b/conf/pam/lms
@@ -0,0 +1,3 @@
+account		required		pam_unix.so
+auth		required		pam_unix.so
+password	required		pam_deny.so
diff --git a/systemd/default.service b/conf/systemd/default.service
similarity index 100%
rename from systemd/default.service
rename to conf/systemd/default.service
diff --git a/src/libs/auth/CMakeLists.txt b/src/libs/auth/CMakeLists.txt
index 9be20d0c..0bcd31c1 100644
--- a/src/libs/auth/CMakeLists.txt
+++ b/src/libs/auth/CMakeLists.txt
@@ -20,9 +20,16 @@ target_link_libraries(lmsauth PRIVATE
 
 target_link_libraries(lmsauth PUBLIC
 	pthread
-	boost_system
+	Boost::system
 	wt
 	)
 
+if (PAM_FOUND)
+	target_compile_options(lmsauth PRIVATE "-DLMS_SUPPORT_PAM")
+	target_sources(lmsauth PRIVATE impl/pam/PAM.cpp)
+	target_include_directories(lmsauth PRIVATE  ${PAM_INCLUDE_DIR})
+	target_link_libraries(lmsauth PRIVATE ${PAM_LIBRARIES})
+endif(PAM_FOUND)
+
 install(TARGETS lmsauth DESTINATION lib)
 
diff --git a/src/libs/auth/impl/AuthTokenService.cpp b/src/libs/auth/impl/AuthTokenService.cpp
index ba37b35c..ff21dbeb 100644
--- a/src/libs/auth/impl/AuthTokenService.cpp
+++ b/src/libs/auth/impl/AuthTokenService.cpp
@@ -17,8 +17,6 @@
  * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/* This file contains some classes in order to get info from file using the libavconv */
-
 #include "AuthTokenService.hpp"
 
 #include <Wt/Auth/HashFunction.h>
diff --git a/src/libs/auth/impl/AuthTokenService.hpp b/src/libs/auth/impl/AuthTokenService.hpp
index 36a9721a..00b0b5a8 100644
--- a/src/libs/auth/impl/AuthTokenService.hpp
+++ b/src/libs/auth/impl/AuthTokenService.hpp
@@ -17,8 +17,6 @@
  * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/* This file contains some classes in order to get info from file using the libavconv */
-
 #pragma once
 
 #include "auth/IAuthTokenService.hpp"
diff --git a/src/libs/auth/impl/LoginThrottler.hpp b/src/libs/auth/impl/LoginThrottler.hpp
index 401e89ee..b8390630 100644
--- a/src/libs/auth/impl/LoginThrottler.hpp
+++ b/src/libs/auth/impl/LoginThrottler.hpp
@@ -17,8 +17,6 @@
  * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/* This file contains some classes in order to get info from file using the libavconv */
-
 #pragma once
 
 #include <shared_mutex>
diff --git a/src/libs/auth/impl/PasswordService.cpp b/src/libs/auth/impl/PasswordService.cpp
index 9c17de2b..af57f5ae 100644
--- a/src/libs/auth/impl/PasswordService.cpp
+++ b/src/libs/auth/impl/PasswordService.cpp
@@ -17,8 +17,6 @@
  * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/* This file contains some classes in order to get info from file using the libavconv */
-
 #include "PasswordService.hpp"
 
 #include <Wt/Auth/HashFunction.h>
@@ -28,6 +26,9 @@
 #include "database/Session.hpp"
 #include "utils/Exception.hpp"
 #include "utils/Logger.hpp"
+#ifdef LMS_SUPPORT_PAM
+#include "pam/PAM.hpp"
+#endif
 
 namespace Auth {
 
@@ -41,10 +42,29 @@ PasswordService::PasswordService(std::size_t maxThrottlerEntries)
 {
 }
 
+bool
+PasswordService::isAuthModeSupported(Database::User::AuthMode authMode) const
+{
+	switch (authMode)
+	{
+		case Database::User::AuthMode::Internal:
+			return true;
+
+		case Database::User::AuthMode::PAM:
+#ifdef LMS_SUPPORT_PAM
+			return true;
+#else
+			return false;
+#endif
+	}
+	return false;
+}
+
 static
 bool
 checkUserPassword(Database::Session& session, const std::string& loginName, const std::string& password)
 {
+	Database::User::AuthMode authMode;
 	Database::User::PasswordHash passwordHash;
 	{
 		auto transaction {session.createSharedTransaction()};
@@ -53,13 +73,28 @@ checkUserPassword(Database::Session& session, const std::string& loginName, cons
 		if (!user)
 			return false;
 
+		authMode = user->getAuthMode();
 		passwordHash = user->getPasswordHash();
 	}
 
-	const Wt::Auth::BCryptHashFunction hashFunc {6};
-	return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
-}
+	switch (authMode)
+	{
+		case Database::User::AuthMode::Internal:
+		{
+			const Wt::Auth::BCryptHashFunction hashFunc {6}; // TODO parametrize this
+			return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
+		}
 
+		case Database::User::AuthMode::PAM:
+#ifdef LMS_SUPPORT_PAM
+			return PAM::checkUserPassword(loginName, password);
+#else
+			return false;
+#endif
+	}
+
+	return false;
+}
 
 PasswordService::PasswordCheckResult
 PasswordService::checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password)
diff --git a/src/libs/auth/impl/PasswordService.hpp b/src/libs/auth/impl/PasswordService.hpp
index 99377e8b..a5b8784c 100644
--- a/src/libs/auth/impl/PasswordService.hpp
+++ b/src/libs/auth/impl/PasswordService.hpp
@@ -46,14 +46,13 @@ namespace Auth {
 			PasswordService(PasswordService&&) = delete;
 			PasswordService& operator=(PasswordService&&) = delete;
 
+		private:
 
-			// Password services
+			bool isAuthModeSupported(Database::User::AuthMode authMode) const;
 			PasswordCheckResult		checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password) override;
 			Database::User::PasswordHash	hashPassword(const std::string& password) const override;
 			bool				evaluatePasswordStrength(const std::string& loginName, const std::string& password) const override;
 
-		private:
-
 			std::shared_timed_mutex	_mutex;
 			LoginThrottler	_loginThrottler;
 	};
diff --git a/src/libs/auth/impl/pam/PAM.cpp b/src/libs/auth/impl/pam/PAM.cpp
new file mode 100644
index 00000000..93869d3f
--- /dev/null
+++ b/src/libs/auth/impl/pam/PAM.cpp
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2020 Emeric Poupon
+ *
+ * This file is part of LMS.
+ *
+ * LMS is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * LMS is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "PAM.hpp"
+
+#include <cstring>
+
+#include "utils/Exception.hpp"
+#include "utils/Logger.hpp"
+
+#include <security/pam_appl.h>
+
+namespace Auth::PAM
+{
+
+class PAMError
+{
+	public:
+		PAMError(std::string_view msg, pam_handle_t *pamh, int err)
+		{
+			_errorMsg = std::string {msg} + ": " + pam_strerror(pamh, err);
+		}
+
+		std::string_view message() const { return _errorMsg; }
+
+	private:
+		std::string _errorMsg;
+};
+
+class PAMContext
+{
+	public:
+		PAMContext(std::string_view loginName)
+		{
+			int err {pam_start("lms", std::string {loginName}.c_str(), &_conv, &_pamh)};
+			if (err != PAM_SUCCESS)
+				throw PAMError {"start failed", _pamh, err};
+		}
+
+		~PAMContext()
+		{
+			int err {pam_end(_pamh, 0)};
+			if (err != PAM_SUCCESS)
+				LMS_LOG(AUTH, ERROR) << "end failed: " << pam_strerror(_pamh, err);
+		}
+
+		void authenticate(std::string_view password)
+		{
+			AuthenticateConvContext authContext {password};
+			ScopedConvContextSetter scopedContext {*this, authContext};
+
+			int err {pam_authenticate(_pamh, 0)};
+			if (err != PAM_SUCCESS)
+				throw PAMError {"authenticate failed", _pamh, err};
+		}
+
+		void validateAccount()
+		{
+			int err {pam_acct_mgmt(_pamh, PAM_SILENT)};
+			if (err != PAM_SUCCESS)
+				throw PAMError {"acct_mgmt failed", _pamh, err};
+		}
+
+	private:
+
+		class ConvContext
+		{
+			public:
+				virtual ~ConvContext() = default;
+		};
+
+		class AuthenticateConvContext final : public ConvContext
+		{
+			public:
+				AuthenticateConvContext(std::string_view password) : _password {password} {}
+
+				std::string_view getPassword() const { return _password; }
+
+			private:
+				std::string_view _password;
+		};
+
+		class ScopedConvContextSetter
+		{
+			public:
+				ScopedConvContextSetter(PAMContext& pamContext, ConvContext& convContext)
+					: _pamContext {pamContext}
+				{
+					_pamContext._convContext = &convContext;
+				}
+
+				~ScopedConvContextSetter()
+				{
+					_pamContext._convContext = nullptr;
+				}
+
+				ScopedConvContextSetter(const ScopedConvContextSetter&) = delete;
+				ScopedConvContextSetter(ScopedConvContextSetter&&) = delete;
+				ScopedConvContextSetter& operator=(const ScopedConvContextSetter&) = delete;
+				ScopedConvContextSetter& operator=(ScopedConvContextSetter&&) = delete;
+
+			private:
+				PAMContext& _pamContext;
+		};
+
+
+		static int conv(int msgCount, const pam_message** msgs, pam_response** resps, void* userData)
+		{
+			if (msgCount < 1)
+				return PAM_CONV_ERR;
+			if (!resps || !msgs || !userData)
+				return PAM_CONV_ERR;
+
+			PAMContext& context {*static_cast<PAMContext*>(userData)};
+
+			AuthenticateConvContext* authenticateContext = dynamic_cast<AuthenticateConvContext*>(context._convContext);
+			if (!authenticateContext)
+			{
+				LMS_LOG(AUTH, ERROR) << "Unexpected conv!";
+				return PAM_CONV_ERR;
+			}
+
+			// Only expect a PAM_PROMPT_ECHO_OFF msg
+			if (msgCount != 1 || msgs[0]->msg_style != PAM_PROMPT_ECHO_OFF)
+			{
+				LMS_LOG(AUTH, ERROR) << "Unexpected conv message. Count = " << msgCount;
+				return PAM_CONV_ERR;
+			}
+
+			pam_response* response {static_cast<pam_response*>(malloc(sizeof(pam_response)))};
+			if (!response)
+				return PAM_CONV_ERR;
+
+			response->resp = strdup(std::string {authenticateContext->getPassword()}.c_str());
+
+			*resps = response;
+			return PAM_SUCCESS;
+		}
+
+		ConvContext* _convContext {};
+		pam_conv _conv {&PAMContext::conv, this};
+		pam_handle_t *_pamh {};
+
+};
+
+bool
+checkUserPassword(const std::string& loginName, const std::string& password)
+{
+	try
+	{
+		PAMContext pamContext {loginName};
+
+		pamContext.authenticate(password);
+		pamContext.validateAccount();
+
+		return true;
+	}
+	catch (const PAMError& error)
+	{
+		LMS_LOG(AUTH, ERROR) << "PAM error: " << error.message();
+		return false;
+	}
+}
+
+} // namespace Auth::PAM
+
diff --git a/src/libs/auth/impl/pam/PAM.hpp b/src/libs/auth/impl/pam/PAM.hpp
new file mode 100644
index 00000000..dd0e9732
--- /dev/null
+++ b/src/libs/auth/impl/pam/PAM.hpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2020 Emeric Poupon
+ *
+ * This file is part of LMS.
+ *
+ * LMS is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * LMS is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#ifdef LMS_SUPPORT_PAM
+
+#include <string>
+
+namespace Auth::PAM
+{
+	bool checkUserPassword(const std::string& loginName, const std::string& password);
+}
+
+#endif // LMS_SUPPORT_PAM
+
diff --git a/src/libs/auth/include/auth/IPasswordService.hpp b/src/libs/auth/include/auth/IPasswordService.hpp
index fb5f9551..1608c972 100644
--- a/src/libs/auth/include/auth/IPasswordService.hpp
+++ b/src/libs/auth/include/auth/IPasswordService.hpp
@@ -48,6 +48,9 @@ namespace Auth {
 				Mismatch,
 				Throttled,
 			};
+
+			virtual bool isAuthModeSupported(Database::User::AuthMode authMode) const = 0;
+
 			virtual PasswordCheckResult	checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password) = 0;
 			virtual Database::User::PasswordHash	hashPassword(const std::string& password) const = 0;
 			virtual bool				evaluatePasswordStrength(const std::string& loginName, const std::string& password) const = 0;
diff --git a/src/libs/av/CMakeLists.txt b/src/libs/av/CMakeLists.txt
index d79974ac..30e72176 100644
--- a/src/libs/av/CMakeLists.txt
+++ b/src/libs/av/CMakeLists.txt
@@ -6,21 +6,26 @@ add_library(lmsav SHARED
 	impl/AvTypes.cpp
 	)
 
+# TODO make av libs private
 target_include_directories(lmsav INTERFACE
 	include
+	${AVCODEC_INCLUDE_DIR}
+	${AVFORMAT_INCLUDE_DIR}
+	${AVUTIL_INCLUDE_DIR}
 	)
 
 target_include_directories(lmsav PRIVATE
 	include/
 	)
 
-# TODO make these private
 target_link_libraries(lmsav PUBLIC
 	lmsutils
 	avformat
 	avutil
 	std::filesystem
 	wt
+	${AVFORMAT_LIBRARY}
+	${AVUTIL_LIBRARY}
 	)
 
 install(TARGETS lmsav DESTINATION lib)
diff --git a/src/libs/database/impl/Session.cpp b/src/libs/database/impl/Session.cpp
index 7cf91fcf..48d3de2e 100644
--- a/src/libs/database/impl/Session.cpp
+++ b/src/libs/database/impl/Session.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Emeric Poupon
+ * Copyright (C) 2020 Emeric Poupon
  *
  * This file is part of LMS.
  *
@@ -40,7 +40,7 @@
 
 namespace Database {
 
-#define LMS_DATABASE_VERSION	24
+#define LMS_DATABASE_VERSION	25
 
 using Version = std::size_t;
 
@@ -267,6 +267,11 @@ CREATE TABLE "user_backup" (
 			// Just increment the scan version of the settings to make the next scheduled scan rescan everything
 			ScanSettings::get(*this).modify()->incScanVersion();
 		}
+		else if (version == 24)
+		{
+			// User's AuthMode
+			_session.execute("ALTER TABLE user ADD auth_mode INTEGER NOT NULL DEFAULT(" + std::to_string(static_cast<int>(User::defaultAuthMode)) + ")");
+		}
 		else
 		{
 			LMS_LOG(DB, ERROR) << "Database version " << version << " cannot be handled using migration";
diff --git a/src/libs/database/impl/User.cpp b/src/libs/database/impl/User.cpp
index 97fa06ab..26321542 100644
--- a/src/libs/database/impl/User.cpp
+++ b/src/libs/database/impl/User.cpp
@@ -70,10 +70,8 @@ AuthToken::getByValue(Session& session, const std::string& value)
 static const std::string playedListName {"__played_tracks__"};
 static const std::string queuedListName {"__queued_tracks__"};
 
-User::User(const std::string& loginName, const PasswordHash& passwordHash)
+User::User(const std::string& loginName)
 : _loginName {loginName}
-, _passwordSalt {passwordHash.salt}
-, _passwordHash {passwordHash.hash}
 {
 }
 
@@ -96,11 +94,11 @@ User::getDemo(Session& session)
 }
 
 User::pointer
-User::create(Session& session, const std::string& loginName, const PasswordHash& passwordHash)
+User::create(Session& session, const std::string& loginName)
 {
 	session.checkUniqueLocked();
 
-	User::pointer user {session.getDboSession().add(std::make_unique<User>(loginName, passwordHash))};
+	User::pointer user {session.getDboSession().add(std::make_unique<User>(loginName))};
 
 	TrackList::create(session, playedListName, TrackList::Type::Internal, false, user);
 	TrackList::create(session, queuedListName, TrackList::Type::Internal, false, user);
diff --git a/src/libs/database/include/database/User.hpp b/src/libs/database/include/database/User.hpp
index 24410c47..8d3e8851 100644
--- a/src/libs/database/include/database/User.hpp
+++ b/src/libs/database/include/database/User.hpp
@@ -100,6 +100,12 @@ class User : public Wt::Dbo::Dbo<User>
 			DEMO	= 2,
 		};
 
+		enum class AuthMode
+		{
+			Internal	= 0,
+			PAM			= 1,
+		};
+
 		struct PasswordHash
 		{
 			std::string salt;
@@ -137,13 +143,14 @@ class User : public Wt::Dbo::Dbo<User>
 		static inline const Bitrate		defaultSubsonicTranscodeBitrate {128000};
 		static inline const UITheme		defaultUITheme {UITheme::Dark};
 		static inline const SubsonicArtistListMode defaultSubsonicArtistListMode {SubsonicArtistListMode::AllArtists};
+		static inline const AuthMode defaultAuthMode {AuthMode::Internal};
 
 
 		User() = default;
-		User(const std::string& loginName, const PasswordHash& passwordHash);
+		User(const std::string& loginName);
 
 		// utility
-		static pointer create(Session& session, const std::string& loginName, const PasswordHash& passwordHash);
+		static pointer create(Session& session, const std::string& loginName);
 
 		static pointer			getById(Session& session, IdType id);
 		static pointer			getByLoginName(Session& session, const std::string& loginName);
@@ -165,6 +172,7 @@ class User : public Wt::Dbo::Dbo<User>
 		void setSubsonicTranscodeBitrate(Bitrate bitrate);
 		void setCurPlayingTrackPos(std::size_t pos)		{ _curPlayingTrackPos = pos; }
 		void setRadio(bool val)					{ _radio = val; }
+		void setAuthMode(AuthMode mode) { _authMode = mode;}
 		void setRepeatAll(bool val)				{ _repeatAll = val; }
 		void setUITheme(UITheme uiTheme)			{ _uiTheme = uiTheme; }
 		void clearAuthTokens();
@@ -179,6 +187,7 @@ class User : public Wt::Dbo::Dbo<User>
 		std::size_t		getCurPlayingTrackPos() const { return _curPlayingTrackPos; }
 		bool			isRepeatAllSet() const { return _repeatAll; }
 		bool			isRadioSet() const { return _radio; }
+		AuthMode		getAuthMode() const { return _authMode; }
 		UITheme			getUITheme() const { return _uiTheme; }
 		SubsonicArtistListMode	getSubsonicArtistListMode() const { return _subsonicArtistListMode; }
 
@@ -218,6 +227,7 @@ class User : public Wt::Dbo::Dbo<User>
 			Wt::Dbo::field(a, _curPlayingTrackPos, "cur_playing_track_pos");
 			Wt::Dbo::field(a, _repeatAll, "repeat_all");
 			Wt::Dbo::field(a, _radio, "radio");
+			Wt::Dbo::field(a, _authMode, "auth_mode");
 			Wt::Dbo::hasMany(a, _tracklists, Wt::Dbo::ManyToOne, "user");
 			Wt::Dbo::hasMany(a, _starredArtists, Wt::Dbo::ManyToMany, "user_artist_starred", "", Wt::Dbo::OnDeleteCascade);
 			Wt::Dbo::hasMany(a, _starredReleases, Wt::Dbo::ManyToMany, "user_release_starred", "", Wt::Dbo::OnDeleteCascade);
@@ -246,6 +256,7 @@ class User : public Wt::Dbo::Dbo<User>
 		int		_curPlayingTrackPos {}; // Current track position in queue
 		bool		_repeatAll {};
 		bool		_radio {};
+		AuthMode	_authMode {defaultAuthMode};
 
 		Wt::Dbo::collection<Wt::Dbo::ptr<TrackList>> _tracklists;
 		Wt::Dbo::collection<Wt::Dbo::ptr<Artist>> _starredArtists;
diff --git a/src/libs/subsonic/impl/SubsonicResource.cpp b/src/libs/subsonic/impl/SubsonicResource.cpp
index 6d793f20..a177590d 100644
--- a/src/libs/subsonic/impl/SubsonicResource.cpp
+++ b/src/libs/subsonic/impl/SubsonicResource.cpp
@@ -597,7 +597,9 @@ handleCreateUserRequest(RequestContext& context)
 	if (User::getByLoginName(context.dbSession, username) != User::pointer{})
 		throw UserAlreadyExistsGenericError {};
 
-	User::pointer user {User::create(context.dbSession, username, hash)};
+	User::pointer user {User::create(context.dbSession, username)};
+	user.modify()->setAuthMode(User::AuthMode::Internal);
+	user.modify()->setPasswordHash(hash);
 
 	return Response::createOkResponse(context);
 }
diff --git a/src/libs/utils/CMakeLists.txt b/src/libs/utils/CMakeLists.txt
index 2dbf4d2c..89505632 100644
--- a/src/libs/utils/CMakeLists.txt
+++ b/src/libs/utils/CMakeLists.txt
@@ -25,7 +25,7 @@ target_link_libraries(lmsutils PRIVATE
 	)
 
 target_link_libraries(lmsutils PUBLIC
-	boost_system
+	Boost::system
 	std::filesystem
 	wt
 	)
diff --git a/src/libs/utils/impl/String.cpp b/src/libs/utils/impl/String.cpp
index edef6744..a2065c75 100644
--- a/src/libs/utils/impl/String.cpp
+++ b/src/libs/utils/impl/String.cpp
@@ -164,6 +164,7 @@ jsEscape(const std::string& str)
 		{ '\r', "\\r" },
 		{ '\t', "\\t" },
 		{ '"', "\\\"" },
+		{ '\'', "\\\'" },
 	};
 
 	std::string escaped;
diff --git a/src/lms/ui/admin/InitWizardView.cpp b/src/lms/ui/admin/InitWizardView.cpp
index e62820b0..a9f3cc3f 100644
--- a/src/lms/ui/admin/InitWizardView.cpp
+++ b/src/lms/ui/admin/InitWizardView.cpp
@@ -64,8 +64,10 @@ class InitWizardModel : public Wt::WFormModel
 			if (!Database::User::getAll(LmsApp->getDbSession()).empty())
 				throw LmsException("Admin user already created");
 
-			Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(AdminLoginField).toUTF8(), passwordHash)};
+			Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(AdminLoginField).toUTF8())};
 			user.modify()->setType(Database::User::Type::ADMIN);
+			user.modify()->setAuthMode(Database::User::AuthMode::Internal);
+			user.modify()->setPasswordHash(passwordHash);
 		}
 
 		bool validateField(Field field)
diff --git a/src/lms/ui/admin/UserView.cpp b/src/lms/ui/admin/UserView.cpp
index 53c27e82..909af333 100644
--- a/src/lms/ui/admin/UserView.cpp
+++ b/src/lms/ui/admin/UserView.cpp
@@ -51,26 +51,30 @@ class UserModel : public Wt::WFormModel
 		static inline const Field LoginField {"login"};
 		static inline const Field PasswordField {"password"};
 		static inline const Field DemoField {"demo"};
+		static inline const Field AuthModeField{"auth-mode"};
+
+		using AuthModeModel = ValueStringModel<User::AuthMode>;
 
 		UserModel(std::optional<Database::IdType> userId)
 		: _userId {userId}
 		{
+			initializeModels();
+
 			if (!_userId)
 			{
 				addField(LoginField);
 				setValidator(LoginField, createNameValidator());
 			}
 
+			addField(AuthModeField);
 			addField(PasswordField);
 			addField(DemoField);
 
-			if (!_userId)
-				setValidator(PasswordField, createMandatoryValidator());
-
-			// populate the model with initial data
 			loadData();
 		}
 
+		std::shared_ptr<AuthModeModel> getAuthModeModel() const { return _authModeModel; }
+
 		void saveData()
 		{
 			std::optional<Database::User::PasswordHash> passwordHash;
@@ -84,8 +88,13 @@ class UserModel : public Wt::WFormModel
 				// Update user
 				Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
 
-				// Account
-				if (passwordHash)
+				auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
+				if (!authModeRow)
+					throw LmsException {"Bad authentication mode"};
+
+				const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
+				user.modify()->setAuthMode(authMode);
+				if (authMode == Database::User::AuthMode::Internal && passwordHash)
 				{
 					user.modify()->setPasswordHash(*passwordHash);
 					user.modify()->clearAuthTokens();
@@ -94,15 +103,70 @@ class UserModel : public Wt::WFormModel
 			else
 			{
 				// Create user
-				Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(LoginField).toUTF8(), *passwordHash)};
+				Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(LoginField).toUTF8())};
 
 				if (Wt::asNumber(value(DemoField)))
 					user.modify()->setType(Database::User::Type::DEMO);
+
+				auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
+				if (!authModeRow)
+					throw LmsException {"Bad authentication mode"};
+
+				const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
+				user.modify()->setAuthMode(authMode);
+				if (authMode == Database::User::AuthMode::Internal)
+					user.modify()->setPasswordHash(*passwordHash);
 			}
 		}
 
 	private:
 
+		void validatePassword(Wt::WString& error) const
+		{
+			auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
+			if (!authModeRow)
+				throw LmsException {"Bad authentication mode"};
+
+			const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
+			if (authMode != Database::User::AuthMode::Internal)
+				return;
+
+			if (!valueText(PasswordField).empty())
+			{
+				if (Wt::asNumber(value(DemoField)))
+				{
+					// Demo account: password must be the same as the login name
+					if (valueText(PasswordField) != getLoginName())
+						error = Wt::WString::tr("Lms.Admin.User.demo-password-invalid");
+				}
+				else
+				{
+					// Evaluate the strength of the password for non demo accounts
+					if (!ServiceProvider<::Auth::IPasswordService>::get()->evaluatePasswordStrength(getLoginName(), valueText(PasswordField).toUTF8()))
+						error = Wt::WString::tr("Lms.password-too-weak");
+				}
+			}
+			else
+			{
+				auto transaction {LmsApp->getDbSession().createSharedTransaction()};
+
+				bool needPassword {true};
+
+				// Allow an empty password if and only if the user previously had one set
+				if (_userId)
+				{
+					const Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
+					if (!user)
+						throw UserNotFoundException {*_userId};
+
+					needPassword = user->getPasswordHash().hash.empty();
+				}
+
+				if (needPassword)
+					error = Wt::WString::tr("Lms.password-must-not-be-empty");
+			}
+		}
+
 		void loadData()
 		{
 			if (!_userId)
@@ -115,6 +179,14 @@ class UserModel : public Wt::WFormModel
 				throw UserNotFoundException {*_userId};
 			else if (user == LmsApp->getUser())
 				throw UserNotAllowedException {};
+
+			auto authModeRow {_authModeModel->getRowFromValue(user->getAuthMode())};
+			if (authModeRow)
+			{
+				setValue(AuthModeField, _authModeModel->getString(*authModeRow));
+				if (_authModeModel->getValue(*authModeRow) != User::AuthMode::Internal)
+					setReadOnly(PasswordField, true);
+			}
 		}
 
 		std::string getLoginName() const
@@ -144,21 +216,7 @@ class UserModel : public Wt::WFormModel
 			}
 			else if (field == PasswordField)
 			{
-				if (!valueText(PasswordField).empty())
-				{
-					if (Wt::asNumber(value(DemoField)))
-					{
-						// Demo account: password must be the same as the login name
-						if (valueText(PasswordField) != getLoginName())
-							error = Wt::WString::tr("Lms.Admin.User.demo-password-invalid");
-					}
-					else
-					{
-						// Evaluate the strength of the password for non demo accounts
-						if (!ServiceProvider<::Auth::IPasswordService>::get()->evaluatePasswordStrength(getLoginName(), valueText(PasswordField).toUTF8()))
-							error = Wt::WString::tr("Lms.password-too-weak");
-					}
-				}
+				validatePassword(error);
 			}
 			else if (field == DemoField)
 			{
@@ -176,7 +234,18 @@ class UserModel : public Wt::WFormModel
 			return false;
 		}
 
+		void initializeModels()
+		{
+			_authModeModel = std::make_shared<AuthModeModel>();
+
+			if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(User::AuthMode::Internal))
+				_authModeModel->add(Wt::WString::tr("Lms.Admin.User.auth-mode.internal"), User::AuthMode::Internal);
+			if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(User::AuthMode::PAM))
+				_authModeModel->add(Wt::WString::tr("Lms.Admin.User.auth-mode.pam"), User::AuthMode::PAM);
+		}
+
 		std::optional<Database::IdType> _userId;
+		std::shared_ptr<AuthModeModel>	_authModeModel;
 };
 
 UserView::UserView()
@@ -213,7 +282,6 @@ UserView::refreshView()
 
 		t->bindString("title", Wt::WString::tr("Lms.Admin.User.user-edit").arg(user->getLoginName()), Wt::TextFormat::Plain);
 		t->setCondition("if-has-last-login", true);
-
 		t->bindString("last-login", user->getLastLogin().toString(), Wt::TextFormat::Plain);
 	}
 	else
@@ -224,6 +292,19 @@ UserView::refreshView()
 		t->bindString("title", Wt::WString::tr("Lms.Admin.User.user-create"));
 	}
 
+	// Auth mode
+	auto authMode = std::make_unique<Wt::WComboBox>();
+	authMode->setModel(model->getAuthModeModel());
+	authMode->activated().connect([=](int row)
+	{
+		const User::AuthMode authMode {model->getAuthModeModel()->getValue(row)};
+
+		model->setReadOnly(UserModel::PasswordField, authMode != User::AuthMode::Internal);
+		t->updateModel(model.get());
+		t->updateView(model.get());
+	});
+	t->setFormWidget(UserModel::AuthModeField, std::move(authMode));
+
 	// Password
 	auto passwordEdit = std::make_unique<Wt::WLineEdit>();
 	passwordEdit->setEchoMode(Wt::EchoMode::Password);
diff --git a/src/lms/ui/common/Validators.cpp b/src/lms/ui/common/Validators.cpp
index 40bf8b91..a1050b8c 100644
--- a/src/lms/ui/common/Validators.cpp
+++ b/src/lms/ui/common/Validators.cpp
@@ -39,7 +39,7 @@ std::shared_ptr<Wt::WValidator>
 createMandatoryValidator()
 {
 	auto v = std::make_shared<Wt::WValidator>();
-	v->setMandatory(true);
+	//sv->setMandatory(true);
 	return v;
 }
 
diff --git a/src/test/database/DatabaseTest.cpp b/src/test/database/DatabaseTest.cpp
index c5edcc1f..54602e89 100644
--- a/src/test/database/DatabaseTest.cpp
+++ b/src/test/database/DatabaseTest.cpp
@@ -708,7 +708,7 @@ testMultipleTracksMultipleClustersTopRelease(Session& session)
 	ScopedRelease releaseB {session, "ReleaseB"};
 	ScopedRelease releaseC {session, "ReleaseC"};
 
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "TrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 
 	{
@@ -1221,7 +1221,7 @@ static
 void
 testSingleUser(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 
 	{
 		auto transaction {session.createSharedTransaction()};
@@ -1240,7 +1240,7 @@ void
 testSingleStarredArtist(Session& session)
 {
 	ScopedArtist artist {session, "MyArtist"};
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 
 	{
 		auto transaction {session.createSharedTransaction()};
@@ -1264,7 +1264,7 @@ void
 testSingleStarredRelease(Session& session)
 {
 	ScopedRelease release {session, "MyRelease"};
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 
 	{
 		auto transaction {session.createUniqueTransaction()};
@@ -1288,7 +1288,7 @@ void
 testSingleStarredTrack(Session& session)
 {
 	ScopedTrack track {session, "MyTrack"};
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 
 	{
 		auto transaction {session.createUniqueTransaction()};
@@ -1311,7 +1311,7 @@ static
 void
 testSingleTrackList(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MytrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 
 	{
@@ -1328,7 +1328,7 @@ static
 void
 testSingleTrackListMultipleTrack(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MytrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 	std::list<ScopedTrack> tracks;
 
@@ -1354,7 +1354,7 @@ static
 void
 testSingleTrackListMultipleTrackSingleCluster(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MyTrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 	ScopedClusterType clusterType {session, "MyClusterType"};
 	ScopedCluster cluster {session, clusterType.lockAndGet(), "MyCluster"};
@@ -1388,7 +1388,7 @@ static
 void
 testSingleTrackListMultipleTrackMultiClusters(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MyTrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 	ScopedClusterType clusterType {session, "MyClusterType"};
 	ScopedCluster cluster1 {session, clusterType.lockAndGet(), "MyCluster1"};
@@ -1443,7 +1443,7 @@ static
 void
 testSingleTrackListMultipleTrackMultiClustersRecentlyPlayed(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MyTrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 	ScopedClusterType clusterType {session, "MyClusterType"};
 	ScopedCluster cluster1 {session, clusterType.lockAndGet(), "MyCluster1"};
@@ -1821,7 +1821,7 @@ void
 testSingleTrackSingleUserSingleBookmark(Session& session)
 {
 	ScopedTrack track {session, "MyTrack"};
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackBookmark bookmark {session, user.lockAndGet(), track.lockAndGet()};
 
 	{