anchor.diff:        [ pkgs.pam ]
         ++ optional config.users.ldap.enable pam_ldap
         ++ optional config.services.sssd.enable pkgs.sssd
  -      ++ optionals config.krb5.enable [pam_krb5 pam_ccreds]
  +      ++ optionals config.security.pam.krb5.enable [pam_krb5 pam_ccreds]
         ++ optionals config.security.pam.enableOTPW [ pkgs.otpw ]
         ++ optionals config.security.pam.oath.enable [ pkgs.oath-toolkit ]
         ++ optionals config.security.pam.p11.enable [ pkgs.pam_p11 ]
  
positive.code:           optionalString config.services.sssd.enable ''
              session optional ${pkgs.sssd}/lib/security/pam_sss.so
            '' +
            optionalString config.krb5.enable ''
              session optional ${pam_krb5}/lib/security/pam_krb5.so
            '' +
            optionalString cfg.otpwAuth ''
  
negative.code: 
      security.pam.enableOTPW = mkEnableOption "the OTPW (one-time password) PAM module";
  
      security.pam.krb5 = {
        enable = mkOption {
          default = config.krb5.enable;
          defaultText = literalExpression "config.krb5.enable";
          type = types.bool;
          description = ''
            Enables Kerberos PAM modules (<literal>pam-krb5</literal>,
            <literal>pam-ccreds</literal>).
  
            If set, users can authenticate with their Kerberos password.
            This requires a valid Kerberos configuration
            (<literal>config.krb5.enable</literal> should be set to
            <literal>true</literal>).
  
            Note that the Kerberos PAM modules are not necessary when using SSS
            to handle Kerberos authentication.
          '';
        };
      };
  
      security.pam.p11 = {
        enable = mkOption {
          default = false;
  