anchor.diff:            optionalString config.services.sssd.enable ''
               password sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_authtok
             '' +
  -          optionalString config.krb5.enable ''
  +          optionalString config.security.pam.krb5.enable ''
               password sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass
             '' +
             optionalString cfg.enableGnomeKeyring ''
  
positive.code: 
      security.pam.enableOTPW = mkEnableOption "the OTPW (one-time password) PAM module";
  
      security.pam.p11 = {
        enable = mkOption {
          default = false;
  
negative.code:           optionalString (config.services.sssd.enable && cfg.sssdStrictAccess) ''
              account [default=bad success=ok user_unknown=ignore] ${pkgs.sssd}/lib/security/pam_sss.so
            '' +
            optionalString config.security.pam.krb5.enable ''
              account sufficient ${pam_krb5}/lib/security/pam_krb5.so
            '' +
            optionalString cfg.googleOsLoginAccountVerification ''
  