Thank you I can attempt to use Rhel8.1 and test that.
One other thing - I note the master branch of openvpn-auth-pam ->
https://github.com/OpenVPN/openvpn/tree/master/src/plugins/auth-pam
Now has
" plugin openvpn-auth-pam.so "login login USERNAME password PASSWORD pin
OTP"
(this isn't in latest stable 2.4.x)
In order to use it you have to add
'static-challenge' to OpenVPN client config
Will this work with sssd ?