anchor.diff:    <%- if values.has_key?('password') -%>
     login = des <%= values['password'] %>
     pap = des <%= values['password'] %>
  +  <%- end -%>
  +  <%- if values.has_key?('cmd') -%>
  +  <%- values['cmd'].each_pair do |cmd, perms| -%>
  +  cmd = "<%= cmd -%>" {
  +  <%- perms.each do |perm| -%>
  +  <%- perm.each_pair do |permission, regex| -%>
  +    <%= permission -%> "<%= regex %>"
  +  <%- end -%>
  +  <%- end -%>
  +  }
  +  <%- end -%>
     <%- end -%>
     <%- else -%>
     member = <%= @default_group %>
  
positive.code:   <%- if values.has_key?('password') -%>
    login = des <%= values['password'] %>
    pap = des <%= values['password'] %>
    <%- end -%>
    <%- else -%>
    member = <%= @default_group %>
  
negative.code: ## Add entries using Puppet.
  #
  
  ## Define Users to be authed by PAM
  
  <% if @users != 'NONE' -%>
  <% users.each_pair do |user, values| -%>
  user = <%= user %> {
  