PAM question

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

This is probably a very easy PAM question

my understanding, for the keywords in a pam conf file:

requisite:  if FAIL then STOP and return "failure"; otherwise, proceed
down stack.
required:  if FAIL continue but eventually return "failure"; if
succeed and last on the stack, return "succeed"
sufficient:  if SUCCEED then STOP and return "succeed"; otherwise,
proceed down the stack, return fail if last on the stack
optional:  only return SUCCEED if at the bottom of the stack and no
other failures (more or less ... I really don't care about this one)

my question is this:

supposedly "required" is required completely but "sufficient"
contradicts this. If you have a sufficient before a required, it makes
the required, well, not required.

Am I reading this correctly?

Site Timeline