We had issues using SCE to configure PAM and ended up doing it with our own Puppet code

Thanks for replying. Yeah, my colleagues have double-checked the code, cd4pe doesn't complain, and I ran it through gemini, which thinks it is ok too. So not sure what is up...I probably missed something. I'll look at it again and maybe see something I missed with a fresh set of eyes after the weekend break.

We use the

pam

module for this ourselves as we have some MFA wedged in those configs on some systems.