Description of problem:
If 2FA(password + otp) is enabled for IPA user it cannot perform kinit.
kinit fails with:
—
$ kinit testuser
kinit: Preauthentication failed while getting initial credentials
—

Version-Release number of selected component (if applicable):
Latest version of IPA and sssd

How reproducible:
Always

Steps to Reproduce:
1. As admin, create a new user with password.
2. Enable OTP authentication for this user.
3. Create an either TOTP or HOTP token for this user.
4. Run kinit as this user.

Actual results:
—
$ kinit testuser
kinit: Generic preauthentication failure while getting initial credentials
—

Expected results:
kinit should work for 2FA(password + otp) enabled IPA user

Additional info:
This is clone of upstream ticket https://pagure.io/freeipa/issue/4411