#%PAM-1.0
auth		[success=done ignore=ignore default=die]	pam_pkcs11.so use_first_pass
auth		requisite	pam_succeed_if.so user ingroup wheel
auth		include		system-auth-use_first_pass-local

password	[success=done ignore=ignore default=die]	pam_pkcs11.so use_first_pass
password	requisite	pam_succeed_if.so user ingroup wheel
password	include		system-auth-use_first_pass-local
