anchor.diff:          description = ''
             If set, fingerprint reader will be used (if exists and
             your fingerprints are enrolled).
  +        '';
  +      };
  +
  +      oathAuth = mkOption {
  +        default = config.security.pam.enableOATH;
  +        type = types.bool;
  +        description = ''
  +          If set, the OATH Toolkit will be used.
           '';
         };
   
  
positive.code:               "session optional ${pam_krb5}/lib/security/pam_krb5.so"}
            ${optionalString cfg.otpwAuth
                "session optional ${pkgs.otpw}/lib/security/pam_otpw.so"}
            ${optionalString cfg.startSession
                "session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
            ${optionalString cfg.forwardXAuth
  
negative.code:               "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth"}
            ${optionalString cfg.otpwAuth
                "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"}
            ${optionalString cfg.oathAuth
                "auth sufficient ${pkgs.oathToolkit}/lib/security/pam_oath.so"} window=5 usersfile=/etc/users.oath
            ${optionalString config.users.ldap.enable
                "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"}
            ${optionalString config.krb5.enable ''
  