nginx auth_pam and groups

I have two questions about using Nginx's auth_pam module to allow HTTPS authorization for a particular group as per their system credentials.

I've added the following to nginx's configuration file:

        location /pamtest/ {
                auth_pam              "Test Zone";
                auth_pam_service_name "nginx";
                try_files $uri $uri/ =404;
        }

Then in /etc/pam.d/nginx:

@include common-auth
@include common-account
@include common-password
@include common-session

auth required pam_listfile.so onerr=fail item=group sense=allow file=/etc/pam.d/nginx.group.allowed

Then in the file /etc/pam.d/nginx.group.allowed, I have listed the groups allowed to log in via HTTPS. All that works, but leaves me worried:

1) The first question is if there is another way to deal with the groups. PAM does not seem to have any module that directly deals with groups and pam_listfile.so seems to be a little complicated. Is there a simpler way to have PAM authorize per system group?

2) The second question is if there is a way to avoid having the nginx user be a member of the group shadow? It seems necessary because that setup seems to use /etc/shadow. The context is that I was looking at webmin and realised that not only do I only need two of its functions but that whole circus runs as root and I won't run my scripts as root. Maybe if I have the script under FastCGI or CGI then I can use some method to launch the scripts as something other than www-data. Maybe it is easier in Apache2.

$ ps -p $(pgrep -f webmin) -o 'user,cmd'
USER     CMD
root     /usr/bin/perl /usr/share/webmin/miniserv.pl /etc/webmin/miniserv.conf

Maybe you can use pam_wheel? pam_wheel lets you specify the group name with group=.

Thanks. However, it does not seem to take. I can use pam_wheel.so to deny specific groups but otherwise it seems to let in everybody.

Maybe the syntax is wrong here?

auth       required   pam_wheel.so      group=foobar2

That looks like it should let just members of the group "foobar2" in but it lets everybody else in too.

I am working on a similar problem on my network. I think I found a solution.

pam_succeed_if

Here is an example that allows me to su to root with no password on my Debian host:

# FILENAME: /etc/pam.d/su
auth       sufficient pam_succeed_if.so use_uid user ingroup tyler

If you want to make sure the user you are trying to login as is in the group, omit the use_uid flag.

tyler is my regular user's primary group, but the module also works with secondary groups.