You're absolutely right. On Debian in /etc/pam.d/common-auth we have:
# here are the per-package modules (the "Primary" block)
auth [success=2 default=ignore] pam_unix.so nullok
auth [success=1 default=ignore] pam_sss.so use_first_pass
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth optional pam_cap.so
# end of pam-auth-update config
A quick hack that removes pam_unix.so and removes the use_first_pass line from pam_sssd.so
results in the OTP prompts being produced by pam_sssd. Thanks!
I've filed
https://bugs.debian.org/1001644 to discuss whether pam_sss can be moved
before pam_unix in the Debian packaging.
--
Sam Morris <
https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9