This bug is created as a clone of upstream ticket:
https://pagure.io/SSSD/sssd/issue/3438

See

       if (resp[1].resp == NULL || *(resp[1].resp) == '\0'
                 || (pi->pam_service != NULL && strcmp(pi->pam_service, "sshd") == 0
                       && strcmp(resp[0].resp, resp[1].resp) == 0)) {
            /* Missing second factor, assume first factor contains combined 2FA
             * credentials.
             * Special handling for SSH with password authentication. Combined
             * 2FA credentials are used but SSH puts them in both responses. */

in

https://github.com/SSSD/sssd/blob/818d01b4a0d332fff06db33c0c985b8c0f1417c7/src/sss_client/pam_sss.c

This code allows only SSHD to combine two factors together but other services might be doing that too. 

User story:
From my application that uses PAM for authentication (WebApp/Radius/Tacacs) I would like to use SSSD for 2FA authentication against IdM. I would like to combine both factors in one prompt for the service I use so that I do not have to implement double prompting in my application.

Proposed approach:
1. SSSD config
single_prompt = sshd, my_app, another_app
2. Pseudo code

        if (resp[1].resp == NULL || *(resp[1].resp) == '\0'
                   || (pi->pam_service != NULL && in_single_prompt_list(pi->pam_service, single_prompt_list) == 0
                          && strcmp(resp[0].resp, resp[1].resp) == 0)) {
       ...