session [default=1]   pam_permit.so
session requisite     pam_deny.so
session required      pam_permit.so
{% if ansible_service_mgr == 'systemd' %}
session optional      pam_systemd.so
{% endif %}
session optional      pam_oddjob_mkhomedir.so skel=/etc/skel umask=0077
session optional      pam_sss.so
session required      pam_unix.so