Stop overriding common PAM files with Debian jessie.

Debian jessie introduced pam-auth-update, which packages call when they have
bits of common PAM configuration.

NEWS

+UNRELEASED
+
+    [pam] Stop overriding common PAM files with Debian jessie. (akkornel)
+
 release/004.056 (2015-11-05)
 
     [sudo] Add an option to support sudo-with-Duo. (adamhl)

manifests/pam/debian.pp

@@ -5,18 +5,22 @@
 class base::pam::debian {
   package { 'libpam-krb5': ensure => present }
   package { 'libpam-afs-session': ensure => present }
-  file {
-    '/etc/pam.d/common-auth':
-      source  => 'puppet:///modules/base/pam/etc/pam.d/common-auth',
-      require => [ Package['libpam-afs-session'],
-                   Package['libpam-krb5'] ];
-   '/etc/pam.d/common-account':
-      source  => 'puppet:///modules/base/pam/etc/pam.d/common-account',
-      require => [ Package['libpam-krb5'] ];
-   '/etc/pam.d/common-session':
-      source  => 'puppet:///modules/base/pam/etc/pam.d/common-session',
-      require => [ Package['libpam-afs-session'],
-                   Package['libpam-krb5'] ];
+
+  # Starting with Debian jessie, pam-auth-update manages the common PAM files.
+  if ($::lsdbmajdistrelease < 8) {
+    file {
+      '/etc/pam.d/common-auth':
+        source  => 'puppet:///modules/base/pam/etc/pam.d/common-auth',
+        require => [ Package['libpam-afs-session'],
+                     Package['libpam-krb5'] ];
+     '/etc/pam.d/common-account':
+        source  => 'puppet:///modules/base/pam/etc/pam.d/common-account',
+        require => [ Package['libpam-krb5'] ];
+     '/etc/pam.d/common-session':
+        source  => 'puppet:///modules/base/pam/etc/pam.d/common-session',
+        require => [ Package['libpam-afs-session'],
+                     Package['libpam-krb5'] ];
+    }
   }
 }