Write out remaining appdefaults entries on client

diff --git a/src/libtdeldap.cpp b/src/libtdeldap.cpp
index 7543268..e9961ed 100644
--- a/src/libtdeldap.cpp
+++ b/src/libtdeldap.cpp
@@ -4904,10 +4904,13 @@
 			ldap_certfile.replace("@@@ADMINSERVER@@@", realmcfg.admin_server);
 			ldap_crlfile.replace("@@@ADMINSERVER@@@", realmcfg.admin_server);
 
-			stream << "	pkinit_anchors = FILE:" << ldap_certfile << "\n";
-			stream << "	pkinit_revoke = FILE:" << ldap_crlfile << "\n";
+			stream << "    pkinit_anchors = FILE:" << ldap_certfile << "\n";
+			stream << "    pkinit_revoke = FILE:" << ldap_crlfile << "\n";
 		}
-		stream << "	pkinit_require_crl_checking = true\n";
+		stream << "    pkinit_require_crl_checking = true\n";
+		stream << "    pam = {\n";
+		stream << "        pkinit_user = PKCS11:" << TDECryptographicCardDevice::pkcsProviderLibrary() << "\n";
+		stream << "    }\n";
 		stream << "\n";
 
 		// Defaults