The option !authenticate is not specified anywhere in the standard sudo schema at
http://www.gratisoft.us/sudo/man/1.8.1/sudoers.ldap.man.html. But this option is found in all the blogs and tutorials as the alternative to the NOPASSWD option in the sudoers file. In the current implementation of sudo plugin we are doing the pam authentication with sudo pam config file. This is done before we query the sssd for authentication for sudo. So that the user will be requested password even if the !authenticate sudoOption is enabled.