diff --git a/pam/Makefile b/pam/Makefile
new file mode 100644
index 0000000..81bfe2f
--- /dev/null
+++ b/pam/Makefile
@@ -0,0 +1,13 @@
+CFLAGS ?= -Wall -Wextra -Werror -fPIC -O2
+LIBDIR ?= /usr/lib/$(shell dpkg-architecture -qDEB_HOST_MULTIARCH)/security
+
+pam_ubuntu_fido_pending.so: pam_ubuntu_fido_pending.c
+	$(CC) $(CFLAGS) -shared -o $@ $< -lpam
+
+install: pam_ubuntu_fido_pending.so
+	install -D -m 0644 pam_ubuntu_fido_pending.so $(DESTDIR)$(LIBDIR)/pam_ubuntu_fido_pending.so
+
+clean:
+	rm -f pam_ubuntu_fido_pending.so
+
+.PHONY: install clean
diff --git a/pam/pam_ubuntu_fido_pending.c b/pam/pam_ubuntu_fido_pending.c
new file mode 100644
index 0000000..054d3ed
--- /dev/null
+++ b/pam/pam_ubuntu_fido_pending.c
@@ -0,0 +1,18 @@
+#define PAM_SM_AUTH
+#include <security/pam_modules.h>
+#include <security/pam_ext.h>
+#include <syslog.h>
+#include <stdio.h>
+
+PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags,
+                                    int argc, const char **argv) {
+    (void)flags; (void)argc; (void)argv;
+    pam_syslog(pamh, LOG_INFO, "ubuntu_fido_pending: stub - allowing");
+    return PAM_IGNORE; /* implemented in Phase 6 */
+}
+
+PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags,
+                              int argc, const char **argv) {
+    (void)pamh; (void)flags; (void)argc; (void)argv;
+    return PAM_SUCCESS;
+}