Bug 1890177

Description of problem: User login is not working if password prompt is changed to single prompt when 2FA is enabled on User level

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:

 On ipaserver(also an IPA client), auth-ind is not set so it will take default value(which depends on global configuration or user-level settings)
---
[root@ipaserver ~]# ipa host-show ipaserver.idm.ipa.com --raw | grep authind
[root@ipaserver ~]# 
---

---
[root@ipaserver ~]# ipa user-show otptest --raw | grep ipauserauthtype <--------- 2FA is enabled for user otptest
  ipauserauthtype: otp
  ipauserauthtype: password
---

   So only "password" should be enough to authenticate and it works fine: 
---
[root@ipaserver ~]# ssh otptest@`hostname`
First Factor: 
Second Factor (optional):  <----- BLANK
Last failed login: Wed Sep  2 09:27:27 EDT 2020 from ipaserver.idm.ipa.com on ssh:notty
There were 2 failed login attempts since the last successful login.
Last login: Wed Sep  2 09:17:39 2020 from localhost
This server is managed by Ansible.
Test
-sh-4.2$ 
---
 
   After changing prompting to provide single prompt doesn't work though, tried this:
---
[prompting/2fa/sshd]
single_prompt = true
first_prompt = Enter Password:
---

   Thought prompt is changed to single prompt but putting just password doesn't work:
---
[root@ipaserver ~]# ssh otptest@`hostname`
Enter Password:
Enter Password:
Enter Password:
---
   as OTP is optional here. Ideally, this should have worked.

Actual results:


Though prompt is changed to single prompt but putting just password doesn't work:
---
[root@ipaserver ~]# ssh otptest@`hostname`
Enter Password:
Enter Password:
Enter Password:
---
   as OTP is optional here. Ideally, this should have worked.


Expected results:

Login should work with only password as otp is optional


Additional info: