I just read the
pam.d man page. It states:
required: failure of such a PAM will ultimately lead to the PAM-API returning failure [...]
requisite: like required, [...]
sufficient: success of such a module is enough to satisfy the authentication requirements of the stack of modules (if a prior required module has failed the success of this one is ignored).
. The description of sufficient doesn't state that it will also be ignored for prior failed requisites. Will it?