[strongSwan] IKEv1 xauth-pam to IKEv2 eap-gtc?

[John Mah]

We're in the process of migrating clients from IKEv1-based connections 
to IKEv2-based connections.

The IKEv1 connections use pubkey & xauth-pam authentication:

conn iphone-ios8
   keyexchange=ikev1
   rightauth=pubkey
   rightauth2=xauth-pam
   [...]

Is there a migration path for IKEv2 connections that makes sense? I see 
there is an eap-gtc module that supports pam but it's not clear in the 
documentation how to configure this to use a specific pam_service.

Any hints would be appreciated.

- John