@!@
krb5_opts = []
if configRegistry.is_true("pam/krb5/ticket_after_pwchange"):
    krb5_opts.append("ticket_after_pwchange")
krb5_minimum_uid = int(configRegistry.get("pam/krb5/minimum_uid", 1000))
print(
    f"""
password requisite         pam_pwquality.so
password sufficient        pam_unix.so obscure use_first_pass use_authtok
password required          pam_krb5.so no_ccache use_first_pass use_authtok force_pwchange minimum_uid={krb5_minimum_uid} """
    + " ".join(krb5_opts)
)
@!@
