#%PAM-1.0
auth		[success=2 default=ignore]	pam_tcb.so shadow fork prefix=$2y$ count=8 nullok use_first_pass
auth		requisite	pam_succeed_if.so uid >= 500 quiet
auth		required	pam_sss.so use_first_pass
auth		required	pam_permit.so

password	[success=2 default=ignore]	pam_tcb.so use_authtok shadow fork prefix=$2y$ count=8 nullok write_to=tcb
password	requisite	pam_succeed_if.so uid >= 500 quiet
password	required	pam_sss.so use_authtok
password	required	pam_permit.so