diff --git a/manifests/pamd/redhat.pp b/manifests/pamd/redhat.pp
index 2b73162..349de18 100644
--- a/manifests/pamd/redhat.pp
+++ b/manifests/pamd/redhat.pp
@@ -16,11 +16,21 @@
   }
 
   file { "${pam::params::prefix_pamd}/system-auth":
-    content => template('pam/pam.d/system-auth-ac.erb')
+    ensure => 'link',
+    target => '/etc/pam.d/system-auth-ac'
+  }
+
+  file { "${pam::params::prefix_pamd}/smartcard-auth-ac":
+    content => template('pam/pam.d/smartcard-auth-ac.erb')
+  }
+
+  file { "${pam::params::prefix_pamd}/smartcard-auth":
+    ensure => 'link',
+    target => '/etc/pam.d/smartcard-auth-ac'
   }
 
   if($pam::pamd::pam_ldap) {
-    
+
     #File['/etc/ldap.conf'] -> File[$pam::params::ldap_conf]
 
     file { '/etc/ldap.conf':
@@ -35,15 +45,15 @@
     5 : {}
 
     6 : {
-      
+
       file { "${pam::params::prefix_pamd}/password-auth-ac":
         ensure  => present,
         content => template('pam/pam.d/system-auth-ac.erb'),
       }
-      
+
       # rhel 6 uses pam_ldap.conf:
       if($pam::pamd::pam_ldap) {
-      
+
         #File['/etc/pam_ldap.conf'] -> File[$pam::params::ldap_conf]
 
         file { '/etc/pam_ldap.conf':
@@ -52,7 +62,7 @@
         }
 
       }
-      
+
     }
 
     default : {
@@ -62,4 +72,3 @@
   }
 
 }
-
diff --git a/manifests/params.pp b/manifests/params.pp
index 70dd48c..4f9ef05 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -49,7 +49,6 @@
         6 : {
           $package_pam_ldap = 'nss-pam-ldapd'
         }
-      
         default : {
           notice("${::operatingsystem} version ${::operatingsystemmajrelease} not handled")
         }
diff --git a/templates/pam.d/smartcard-auth-ac.erb b/templates/pam.d/smartcard-auth-ac.erb
new file mode 100644
index 0000000..586acdf
--- /dev/null
+++ b/templates/pam.d/smartcard-auth-ac.erb
@@ -0,0 +1,26 @@
+###############################################################################
+# << FILE MANAGED BY PUPPET >>
+# Manual changes are likey to be overwritten
+###############################################################################
+auth        required      pam_env.so
+auth        [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card card_only
+auth        required      pam_deny.so
+
+account     required      pam_unix.so broken_shadow
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 500 quiet
+<% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%>
+account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %>
+<% end -%>
+account     required      pam_permit.so
+
+password    required      pam_pkcs11.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+session     optional      pam_mkhomedir.so skel=/etc/skel umask=0077
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
+<% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%>
+session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %>
+<% end -%>
diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb
index 0a37784..81fdcd3 100644
--- a/templates/pam.d/system-auth-ac.erb
+++ b/templates/pam.d/system-auth-ac.erb
@@ -18,15 +18,16 @@ auth  <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %>
 auth        required      pam_deny.so
 
 <% if scope.lookupvar('pam::pamd::pam_tally') == true then -%>
-account	<%= scope.lookupvar('pam::pamd::pam_tally_account_set') %>
+account <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %>
 <% end -%>
 <% if scope.lookupvar('pam::pamd::pam_tally2') == true then -%>
-account	<%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %>
+account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %>
 <% end -%>
 account     required      pam_unix.so broken_shadow
+account     sufficient    pam_localuser.so
 account     sufficient    pam_succeed_if.so uid < 500 quiet
 <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%>
-account	<%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %>
+account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %>
 <% end -%>
 account     required      pam_permit.so
 
@@ -39,9 +40,11 @@ password    required      pam_deny.so
 
 session     optional      pam_keyinit.so revoke
 session     required      pam_limits.so
+<% if scope.lookupvar('pam::pamd::pam_mkhomedir') == true then -%>
+session <%= scope.lookupvar('pam::pamd::pam_mkhomedir_session') %>
+<% end -%>
 session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
 session     required      pam_unix.so
 <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%>
-session	<%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %>
+session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %>
 <% end -%>
-