Escape PAM special characters properly

README.md

@@ -557,6 +557,13 @@ variables serving as overrides:
     - Default Value: `False`
     - Environment Variable Override: `PYTHON_IRODSCLIENT_CONFIG__LEGACY_AUTH__PAM__STORE_PASSWORD_TO_ENVIRONMENT`
 
+-   Setting: Force the use of PAM_AUTH_REQUEST_AN API for entering a new PAM password into the catalog.  This API accommodates longer passwords and avoids the step of parsing a semicolon-delimited
+    "context" parameter.
+    - Dotted Name: `legacy_auth.pam.force_use_of_dedicated_pam_api`
+    - Type: `bool`
+    - Default Value: `False`
+    - Environment Variable Override: `PYTHON_IRODSCLIENT_CONFIG__LEGACY_AUTH__PAM__FORCE_USE_OF_DEDICATED_PAM_API`
+
 -   Setting: Default choice of XML parser for all new threads.
     -   Dotted Name: `connections.xml_parser_default`
     -   Type: `str`

irods/connection.py

@@ -489,10 +489,9 @@ def _login_pam(self):
             if getattr(self,'DISALLOWING_PAM_PLAINTEXT',True):
                 raise PlainTextPAMPasswordError
 
-        # Normally, we use the AUTH_PLUG_REQ_AN api ( generalized to handle both PAM and GSI, as evidenced in the gsi_client_auth_request() method.)
-        # However, it has a practical limit to the number of characters in a context_ parameter (defined in packStruct as str[MAX_NAME_LEN].
-        # Whereas PAM_AUTH_REQUEST_AN is an older api and defines pamPassword as type str*, with apparently no length limit.
-        # TODO : perhaps we should always use PAM_AUTH_REQUEST_AN ??
+        # Normally, we use the AUTH_PLUG_REQ_AN api (generalized to handle both PAM and GSI, as evidenced in the gsi_client_auth_request() method.)
+        # However, it has a practical limit to the number of characters in a context_ parameter (defined in packStruct as "str[MAX_NAME_LEN]".
+        # Whereas PAM_AUTH_REQUEST_AN is an older api and defines pamPassword as a "str*" entry, with apparently no length limit.
 
         use_dedicated_pam_api = (len(ctx) >= MAX_NAME_LEN) or \
                                 cfg.legacy_auth.pam.force_use_of_dedicated_pam_api