This could also be implemented using pam_listfile.so and a very short awk script invoked by cron, but it's common enough to have been separated out.
All module types (account, auth, password and session) are provided.
Add the following line to /etc/pam.d/su to allow only local users in group wheel to use su.
account sufficient pam_localuser.so account required pam_wheel.so
pam.conf(5), pam.d(5), pam(7)
pam_localuser was written by Nalin Dahyabhai <email@example.com>.