The spwd module has several flaws. Especially the combination of spwd and crypt for password verification is dangerous and in almost all cases technically wrong. 

    # don't do this!
    pw1 = spwd.getspnam(username).sp_pwd
    pw2 = crypt.crypt(password, pw1)
    if pw1 == pw2:
        ...

On BSD, Linux, and macOS, account and credential verification must go through PAM.

Also see:
https://mail.python.org/pipermail/python-dev/2019-May/157562.html
https://mail.python.org/pipermail/python-dev/2019-May/157564.html

"... must go through PAM."

Do you have a Python module to recommend to access PAM API?

> On BSD, Linux, and macOS, account and credential verification must go through PAM.

At least the part about Linux is not entirely true.
If PAM is installed and used, then account and credential verification should probably go through PAM, but system administrator is free to decide to not install PAM at all.

Perhaps some Linux distributions like Red Hat and Fedora do not support PAM-free systems, but Gentoo certainly supports PAM-free systems (support for PAM is enabled by default in Gentoo, but is not enforced).