minimum_uid = int(configRegistry.get('pam/krb5/minimum_uid', 1000))

METHODS = [

pam_krb5='''

    ('krb5', 'pam_krb5.so minimum_uid=%s' % (configRegistry.get('pam/krb5/minimum_uid', 1000),)),

account  <action>                         pam_krb5.so minimum_uid=%d''' % (minimum_uid,)

    ('ldap', 'pam_ldap.so'),

pam_ldap='''

    ('winbind', 'pam_winbind.so'),

account  <action>                         pam_ldap.so'''

]

pam_winbind='''

methods = set(configRegistry['auth/methods'].split())

account  <action>                         pam_winbind.so'''

stmts = [stmt for (method, stmt) in METHODS if method in methods]

for i, stmt in enumerate(stmts):

def pam_section(template, index):

    action = "[success=%d new_authtok_reqd=done default=ignore]" % (len(stmts) - i,)

	action = 'required  ' if index <= 1 else 'sufficient'

    print("account  %s  %s" % (action, stmt))

	return template.replace('<action>', action)

methods = set(configRegistry['auth/methods'].split(' ')) & {'krb5', 'ldap', 'winbind'}

index = len(methods)

if 'krb5' in methods:

	print(pam_section(pam_krb5, index))

	index -= 1

if 'ldap' in methods:

	print(pam_section(pam_ldap, index))

	index -= 1

if 'winbind' in methods:

	print(pam_section(pam_winbind, index))

minimum_uid = int(configRegistry.get('pam/krb5/minimum_uid', 1000))

METHODS = [

pam_krb5='''

    ('krb5', 'pam_krb5.so use_first_pass minimum_uid=%d' % (configRegistry.get('pam/krb5/minimum_uid', 1000),)),

auth	sufficient			pam_krb5.so use_first_pass minimum_uid=%d''' % (minimum_uid,)

    ('ldap', 'pam_ldap.so use_first_pass'),

pam_ldap='''

    ('winbind', 'pam_winbind.so use_first_pass'),

auth 	sufficient 			pam_ldap.so use_first_pass'''

]

pam_winbind=''' 

methods = set(configRegistry['auth/methods'].split())

auth 	sufficient 			pam_winbind.so use_first_pass'''

stmts = [stmt for (method, stmt) in METHODS if method in methods]

for i, stmt in enumerate(stmts):

methods = set(configRegistry['auth/methods'].split(' ')) & {'krb5', 'ldap', 'winbind'}

    action = "[success=%d default=ignore]" % (len(stmts) - i,)

    print("auth  %s  %s" % (action, stmt))

if 'krb5' in methods:

	print(pam_krb5)

if 'ldap' in methods:

	print(pam_ldap)

if 'winbind' in methods:

	print(pam_winbind)

minimum_uid = int(configRegistry.get('pam/krb5/minimum_uid', 1000))

METHODS = [

pam_krb5 = '''

    ('krb5', 'pam_krb5.so use_first_pass minimum_uid=%d' % (configRegistry.get('pam/krb5/minimum_uid', 1000),)),

auth     [success=<succ> new_authtok_reqd=ok \

    ('ldap', 'pam_ldap.so use_first_pass'),

         user_unknown=<unknown> \

    ('winbind', 'pam_winbind.so use_first_pass'),

         service_err=<unavail> authinfo_unavail=<unavail> \

]

         default=<unknown>]                         pam_krb5.so use_first_pass minimum_uid=%d''' % (minimum_uid,)

methods = set(configRegistry['auth/methods'].split())

pam_ldap = '''

stmts = [stmt for (method, stmt) in METHODS if method in methods]

auth     [success=<succ> new_authtok_reqd=ok \

         user_unknown=<unknown> \

         service_err=<unavail> authinfo_unavail=<unavail> \

         default=<unknown>]                         pam_ldap.so use_first_pass'''

pam_winbind = '''

auth     [success=<succ> new_authtok_reqd=ok \

         user_unknown=<unknown> \

         service_err=<unavail> authinfo_unavail=<unavail> \

         default=<unknown>]                         pam_winbind.so use_first_pass'''

def pam_section(template, last):

if not stmts:

	succ='done'

	unavail='die'

	fail='die'

	unknown = 'die' if last else 'ignore'

	return template.replace('<succ>', succ).replace('<unavail>', unavail).replace('<fail>', fail).replace('<unknown>', unknown)

methods = [x for x in configRegistry['auth/methods'].split(' ') if x in ['krb5', 'ldap', 'winbind']]

if not methods:

if 'krb5' in methods:

for i, stmt in enumerate(stmts):

	last = 'ldap' not in methods and 'winbind' not in methods

    action = "[success=%d new_authtok_reqd=ok user_unknown=ignore service_err=die authinfo_unavail=die default=ignore]" % (len(stmts) - i,)

	print(pam_section(pam_krb5, last))

    print("auth  %s  %s" % (action, stmt))

if 'ldap' in methods:

	last = 'winbind' not in methods

	print(pam_section(pam_ldap, last))

if 'winbind' in methods:

	print(pam_section(pam_winbind, true))