In the Linux environment, PAM is usually the “glue” that is ordinarily used, as it was designed and intended to be, although implementations vary.     “Password” authentication is commonly superseded, and even disallowed.   Thus, the corporate security team has definitive and exclusive control.   (A “password” alternative would be tantamount to a “back door,” from their very-sensible point of view.)