CentOS - Aug 2018 - C7, system-auth-ac, and authconfig

I read the clear-as-mud docs, and it appears that if we want to modify
system-auth-ac, we can create a local, and point system-auth to it.

Howver.. in the default, I see
auth        [success=3 default=ignore] pam_succeed_if.so service notin
login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet
use_uid

Now, we'd like to add sudo to that list. Does anyone know *where*
authconfig gets that list in the first place? I haven't been able to find
anything yet, and I've been looking.

      mark