anchor.diff:          description = ''
             If set, fingerprint reader will be used (if exists and
             your fingerprints are enrolled).
  +        '';
  +      };
  +
  +      oathAuth = mkOption {
  +        default = config.security.pam.enableOATH;
  +        type = types.bool;
  +        description = ''
  +          If set, the OATH Toolkit will be used.
           '';
         };
   
  
positive.code:               "session optional ${pam_krb5}/lib/security/pam_krb5.so"}
            ${optionalString cfg.otpwAuth
                "session optional ${pkgs.otpw}/lib/security/pam_otpw.so"}
            ${optionalString cfg.startSession
                "session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
            ${optionalString cfg.forwardXAuth
  
negative.code:       [ pkgs.pam ]
        ++ optional config.users.ldap.enable pam_ldap
        ++ optionals config.krb5.enable [pam_krb5 pam_ccreds]
        ++ optionals config.security.pam.enableOTPW [ pkgs.otpw ]
        ++ optionals config.security.pam.enableOATH [ pkgs.oathToolkit ];
  
      environment.etc =
        mapAttrsToList (n: v: makePAMService v) config.security.pam.services;
  