https://github.com/SSSD/sssd/issues/7456

```
After updating from 9.3 to 9.4 sssd started to enforce 2FA for our sudo configuration, while before it was optional, and we can't find why did it change.
We downgraded sssd packages from 2.9.4 to 2.9.1 and 2FA went back to being optional, so we are sure it's because sssd version change from 2.9.1->2.9.4, all other configuration is the same.

I looked through changelogs and skimmed through the list of commits, but I couldn't find anything obvious that should change this. Seems like a bug or side-effect of other changes.

We are using IPA as Kerberos provider, users do have OTP set up.
Up to 2.9.1 sudoing worked either with only password or password+otp.
On 2.9.4 (and 2.9.5) sudoing is not working with only password, both password+otp are required.
```