anchor.diff:  
       security.pam.enableOTPW = mkEnableOption "the OTPW (one-time password) PAM module";
   
  +    security.pam.krb5 = {
  +      enable = mkOption {
  +        default = config.krb5.enable;
  +        defaultText = literalExpression "config.krb5.enable";
  +        type = types.bool;
  +        description = ''
  +          Enables Kerberos PAM modules (<literal>pam-krb5</literal>,
  +          <literal>pam-ccreds</literal>).
  +
  +          If set, users can authenticate with their Kerberos password.
  +          This requires a valid Kerberos configuration
  +          (<literal>config.krb5.enable</literal> should be set to
  +          <literal>true</literal>).
  +
  +          Note that the Kerberos PAM modules are not necessary when using SSS
  +          to handle Kerberos authentication.
  +        '';
  +      };
  +    };
  +
       security.pam.p11 = {
         enable = mkOption {
           default = false;
  
positive.code:           optionalString (config.services.sssd.enable && cfg.sssdStrictAccess) ''
              account [default=bad success=ok user_unknown=ignore] ${pkgs.sssd}/lib/security/pam_sss.so
            '' +
            optionalString config.krb5.enable ''
              account sufficient ${pam_krb5}/lib/security/pam_krb5.so
            '' +
            optionalString cfg.googleOsLoginAccountVerification ''
  
negative.code:           optionalString config.services.sssd.enable ''
              session optional ${pkgs.sssd}/lib/security/pam_sss.so
            '' +
            optionalString config.security.pam.krb5.enable ''
              session optional ${pam_krb5}/lib/security/pam_krb5.so
            '' +
            optionalString cfg.otpwAuth ''
  