I've written code against RSA's API and found the docs terrible and
the libraries painful to use.   RSA has a RADIUS server fronting their
server so I expect I could use that instead, might be easier.  This is
on Solaris10 x86 which supports PAM but I've never accessed PAM from
Python, any pointers?

I've done RADIUS before (Cistron, Ascend, FreeRADIUS) but not with
Python. Any suggestions? I see a pyrad library, last updated in March
2006; any experience with it? Any other suggestions?

I recommend going with pyrad and using the Radius interface.  This
will allow you to use a third party radius server if you want and
since all the two-factor vendors support radius, you won't have to re-
write the apps if you switch strong authentication vendors.

HTH,

nick