It is impossible to use "new" control flag (like [success=1 ignore=ignore]) in config files, due to a parsing bug. I'll send a patch for this as soon as I have a bug number...
Integrated in pam-0.68-3 and later. thanks,
Commit pushed to master at https://github.com/openshift/origin https://github.com/openshift/origin/commit/1cc002a251afbe87039712f0c33db4d5b07f5fa1 Merge pull request #9474 from gabemontero/issue3902 Merged by openshift-bot