PBIS: domain-join Utility Creates Wrong Stack-Order When pam_faillock Present

[ferricoxide]

The pbis.sls leverages the PBIS domainjoin-cli utility to do the heavy-lifting surrounding joining the client to the domain. However, the domainjoin-cli utility (through at least PBIS 8.3.0) defaults to inserting pam_lsass modules late in the /etc/pam.d/password-auth stack. When the pam_faillock modules are present ahead of the pam_lsass modules and a PBIS user attempts to perform password-based authentication, the pam_faillock modules abort the PAM-call before the pam_lsass modules may be referenced. This results in PBIS users only being able to do non-PAM authentications (SSH key, GSSAPI tokens, etc.)