control fingerprint auth with a variable

group_vars/all

@@ -102,3 +102,5 @@ bootloader: grub
 
 postgresql:
     enable: True
+
+fingerprint: False

roles/thinkpad/tasks/main.yml

@@ -25,15 +25,12 @@
   tags:
     - fingerprint
 
-- name: Enable sudo fingerprint authentication
-  lineinfile: dest=/etc/pam.d/sudo
-              state=present
-              insertbefore=BOF
-              line="auth            sufficient      pam_fprintd.so"
+- name: Push sudo authentication file
+  template: src=pam.d/sudo.j2 dest=/etc/pam.d/sudo
   tags:
     - fingerprint
 
-- name: Enable i3lock fingerprint authentication
-  copy: src=i3lock dest=/etc/pam.d/i3lock
+- name: Push i3lock authentication file
+  template: src=pam.d/i3lock.j2 dest=/etc/pam.d/i3lock
   tags:
     - fingerprint

roles/thinkpad/templates/pam.d/i3lock.j2

@@ -1,3 +1,7 @@
+{% if fingerprint == True %}
 auth required    pam_env.so
 auth sufficient  pam_unix.so try_first_pass likeauth nullok
 auth sufficient  pam_fprintd.so
+{% else %}
+auth include system-auth
+{% endif %}

roles/thinkpad/templates/pam.d/sudo.j2

@@ -0,0 +1,6 @@
+{% if fingerprint == True %}
+auth            sufficient      pam_fprintd.so
+{% endif %}
+auth            include         system-auth
+account         include         system-auth
+session         include         system-auth