ad-auth: do not deploy mkhomedir on clients

ad-auth/tasks/pam.yml

 ---
 # file: roles/ad-auth/tasks/pam.yml
 
-- name: ensure our pam-configs are deployed
-  copy: src=pam/{{ item }} dest=/usr/share/pam-configs/{{ item }} owner=root group=root mode=0644
-  with_items:
-    - mkhomedir
-    - umask
+- name: ensure pam applies a general umask
+  copy: src=pam/umask dest=/usr/share/pam-configs/umask owner=root group=root mode=0644
+  notify:
+    - regenerate pam config
+  tags:
+    - pam 
+    - config
+
+- name: ensure pam creates a home dir if necessary
+  copy: src=pam/mkhomedir dest=/usr/share/pam-configs/mkhomedir owner=root group=root mode=0644
+  when: "'clients' not in group_names"
   notify:
     - regenerate pam config
   tags: