I have already explained this in my previous post. Did you read this?
> Yes, I do.
So why postgresql give users an abbility to use a pam modules, when in other side there is advice to not use them? Anyway.
> Where is such advise? I can't see it in docs [1].
Not in docs. You gave such advice: "Therefore, advise PAM users to use HBA is a way to not complicate the actual feature".
I do not see any complication with this approach. Just use one configuration entry in pg_hba.conf, and rest entries in some database backend of pam module, which is most convenient with lot of entries than editing pg_hba.conf.
Why don't you use a group role? I need just one entry in pg_hba.conf.