[CentOS] pam and sasl2-sample-server failure

I'm setting up a postfix server using "The Book of Postfix".  In ch 15
there is a section on testing saslauthd which I can't get to work.  I
can get it to work using shadow password authentication, but it fails
on pam.  I don't kow squat about troubleshooting pam.  Any PAM wizzes
out there that can help?  I saw a unrelated post talking about
something needing to be in the pam sasl group.  Had no idea what that
meant.  sasl ins't a user, or group.

I setup and try

saslauthd -m /var/run/saslauthd -a pam -d
sasl2-sample-server -s rcmd -p 8000
sasl2-sample-client -s rcmd -p 8000 -m LOGIN 127.0.0.1

If I set "-a shadow" it works.  So I assume I have saslauthd working
at least.

But, if I set "-a pam" as listed above, it fails

I believe it may be a PAM issue, could be sasl, but I'm hoping maybe
someone will see the easy answer.

I have in /etc/pam.d/smtp
#%PAM-1.0
auth       required     pam_stack.so service=system-auth
account    required     pam_stack.so service=system-auth

Also:
# saslauthd -v
saslauthd 2.1.19
authentication mechanisms: getpwent kerberos5 pam rimap shadow ldap

And /usr/lib/sasl2/smtpd.conf  (also linked to sample.conf)
# cat smtpd.conf
loglevel: 7
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN

Here are the results of a failed attempt:
-------------------------------------

# saslauthd -m /var/run/saslauthd -a pam -d
saslauthd[3176] :main            : num_procs  : 5
saslauthd[3176] :main            : mech_option: NULL
saslauthd[3176] :main            : run_path   : /var/run/saslauthd
saslauthd[3176] :main            : auth_mech  : pam
saslauthd[3176] :ipc_init        : using accept lock file:
/var/run/saslauthd/mux.accept
saslauthd[3176] :detach_tty      : master pid is: 0
saslauthd[3176] :ipc_init        : listening on socket:
/var/run/saslauthd/mux
saslauthd[3176] :main            : using process model
saslauthd[3177] :get_accept_lock : acquired accept lock
saslauthd[3176] :have_baby       : forked child: 3177
saslauthd[3176] :have_baby       : forked child: 3178
saslauthd[3176] :have_baby       : forked child: 3179
saslauthd[3176] :have_baby       : forked child: 3180
saslauthd[3177] :rel_accept_lock : released accept lock
saslauthd[3177] :do_auth         : auth failure: [user=testuser]
[service=rcmd] [realm=] [mech=pam] [reason=PAM auth error]

# sasl2-sample-server -s rcmd -p 8000
trying 2, 1, 6
trying 10, 1, 6
socket: Address family not supported by protocol
accepted new connection
send: {11}
PLAIN LOGIN
recv: {5}
LOGIN
recv: {1}
N
send: {9}
Username:
recv: {7}
testuser
send: {9}
Password:
recv: {6}
xxxxxx
performing SASL negotiation: authentication failureclosing connection


# sasl2-sample-client -s rcmd -p 8000 -m LOGIN 127.0.0.1
receiving capability list... recv: {11}
PLAIN LOGIN
PLAIN LOGIN
send: {5}
LOGIN
send: {1}
N
recv: {9}
Username:
please enter an authentication id: testuser
Password:
send: {7}
testuser
recv: {9}
Password:
send: {6}
xxxxxx
authentication failed
closing connection

--------------
# From syslog:

Sep 19 09:33:45 tn1 saslauthd[3209]: main            : num_procs  : 5
Sep 19 09:33:45 tn1 saslauthd[3209]: main            : mech_option:
NULL
Sep 19 09:33:45 tn1 saslauthd[3209]: main            : run_path   :
/var/run/saslauthd
Sep 19 09:33:45 tn1 saslauthd[3209]: main            : auth_mech  :
pam
Sep 19 09:33:45 tn1 saslauthd[3209]: ipc_init        : using accept
lock file: /var/run/saslauthd/mux.accept
Sep 19 09:33:45 tn1 saslauthd[3209]: detach_tty      : master pid is:
0
Sep 19 09:33:45 tn1 saslauthd[3209]: ipc_init        : listening on
socket: /var/run/saslauthd/mux
Sep 19 09:33:45 tn1 saslauthd[3209]: main            : using process
model
Sep 19 09:33:45 tn1 saslauthd[3210]: get_accept_lock : acquired accept
lock
Sep 19 09:33:45 tn1 saslauthd[3209]: have_baby       : forked child:
3210
Sep 19 09:33:45 tn1 saslauthd[3209]: have_baby       : forked child:
3211
Sep 19 09:33:45 tn1 saslauthd[3209]: have_baby       : forked child:
3212
Sep 19 09:33:45 tn1 saslauthd[3209]: have_baby       : forked child:
3213
Sep 19 09:34:03 tn1 saslauthd[3210]: rel_accept_lock : released accept
lock
Sep 19 09:34:03 tn1 saslauthd[3210]: DEBUG: auth_pam: pam_authenticate
failed: Authentication failure
Sep 19 09:34:03 tn1 saslauthd[3210]: do_auth         : auth failure:
[user=testuser] [service=rcmd] [realm=] [mech=pam] [reason=PAM auth
error]
Sep 19 09:34:03 tn1 saslauthd[3210]: get_accept_lock : acquired accept
lock