anchor.diff:                "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth"}
             ${optionalString cfg.otpwAuth
                 "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"}
  +          ${optionalString cfg.oathAuth
  +              "auth sufficient ${pkgs.oathToolkit}/lib/security/pam_oath.so"} window=5 usersfile=/etc/users.oath
             ${optionalString config.users.ldap.enable
                 "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"}
             ${optionalString config.krb5.enable ''
  
positive.code:               "session optional ${pam_krb5}/lib/security/pam_krb5.so"}
            ${optionalString cfg.otpwAuth
                "session optional ${pkgs.otpw}/lib/security/pam_otpw.so"}
            ${optionalString cfg.startSession
                "session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
            ${optionalString cfg.forwardXAuth
  
negative.code:         description = ''
            If set, fingerprint reader will be used (if exists and
            your fingerprints are enrolled).
          '';
        };
  
        oathAuth = mkOption {
          default = config.security.pam.enableOATH;
          type = types.bool;
          description = ''
            If set, the OATH Toolkit will be used.
          '';
        };
  
  