+h2(#pam). PAM (experimental)
+
+With this configuration, authentication is done according to the Linux PAM configuration on your controller host.
+
+Enable PAM authentication in @config.yml@:
+
+<pre>
+ Login:
+ PAM: true
+</pre>
+
+Check the "default config file":{{site.baseurl}}/admin/config.html for more PAM configuration options.
+
+h2(#sso). Separate single-sign-on (SSO) server
+
+With this configuration, Arvados passes off authentication to a separate SSO server that supports Google, LDAP, and a local password database.