This is a standard Redhat Enterprise Linux PAM configuration showing the correct order of modules in the PAM stack:
auth required pam_env.so
auth sufficient pam_vas3.so create_homedir get_nonvas_pass try_first_pass
auth requisite pam_vas3.so echo_return
auth sufficient pam_unix.so nullok try_first_pass use_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so