pam provider ignores password-auth

I have configuration like this
```
class add_radius_config {
  pam { "Add radius authentication to system-auth":
    ensure => present,
    service => "system-auth",
    type => "auth",
    module => "pam_radius_auth.so",
    position => "after module pam_env.so",
    arguments => ["try_first_pass", "localifdown", "conf=/etc/sysconfig/raddb", "client_id=tacacs"],
    control => "sufficient"
  }

  pam { "Add radius authentication password-auth":
    ensure => present,
    service => "password-auth-ac",
    type => "auth",
    module => "pam_radius_auth.so",
    position => "after module pam_env.so",
    arguments => ["try_first_pass", "localifdown", "conf=/etc/sysconfig/raddb", "client_id=tacacs"],
    control => "sufficient",
  }
}
```
For some strange reason, it only applies system-auth, and ignores password-auth 
completely. I cannot see anything in logs about it. If I change system-auth, it will repair the settings, but not for password-auth.