Operations that change or set identity include logging in to the system, invoking an rcp or rsh command, using ftp, or using su. When an operation involves changing or setting an identity, a set of configurable modules is used to provide authentication, account management, credentials management, and session management.
For an overview of PAM, see Chapter 1, Using Pluggable Authentication Modules, in Managing Kerberos and Other Authentication Services in Oracle Solaris 11.2 .