session [default=1]   pam_permit.so
session requisite     pam_deny.so
session required      pam_permit.so
{% if ansible_distribution_major_version is version('9', '>=') %}
session optional      pam_oddjob_mkhomedir.so skel=/etc/skel umask=0077
{% else %}
session optional      pam_mkhomedir.so skel=/etc/skel umask=0077
{% endif %}
session optional      pam_sss.so
session required      pam_unix.so