Using pam_pkcs11 we can use the parameter 'wait_for_card' to halt the pam process until a smart card is inserted. Is there any feature like that with pam_sss? 

Use case is to require smart card for logins. With GDM this is configured via dconf, but with console/tty logins there is no such configuration available as I know of. So with pam_sss you can freely logon to a TTY without using smartcard. Or maybe there is a solution out there I'm missing?

Regards
Adam