@!@
krb5_opts = []
if configRegistry.is_true('pam/krb5/ticket_after_pwchange'):
    krb5_opts.append('ticket_after_pwchange')
krb5_minimum_uid = int(configRegistry.get('pam/krb5/minimum_uid', 1000))
print(f'''
password requisite         pam_pwquality.so
password sufficient        pam_unix.so obscure use_first_pass use_authtok
password required          pam_krb5.so use_first_pass use_authtok force_pwchange minimum_uid={krb5_minimum_uid} ''' + ' '.join(krb5_opts))
@!@
