Description of problem:

I'm attempting to require the use of smartcards everywhere.  authselect profile:

Profile ID: sssd
Enabled features:
- with-smartcard
- with-smartcard-required
- with-smartcard-lock-on-removal
- with-sudo
- with-custom-automount
- with-mkhomedir
- with-faillock

I had to modify /etc/pam.d/system-auth to add "kde" (use by plasma screen locker) to the list of services below:

auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        required                                     pam_faillock.so preauth silent
auth        [success=1 default=ignore]                   pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kde:kscreensaver quiet use_uid
auth        [success=done ignore=ignore default=die]     pam_sss.so require_cert_auth ignore_authinfo_unavail
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        [default=2 ignore=ignore success=ok]         pam_localuser.so
auth        [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth
auth        sufficient                                   pam_unix.so nullok try_first_pass
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        sufficient                                   pam_sss.so forward_pass
auth        required                                     pam_faillock.so authfail
auth        required                                     pam_deny.so

When I lock the screen and unlock with my password, the message:

Please insert smart card labeled Orion Poplawski

is displayed, but then the screen unlocks.  pam log messgges:

kcheckpass[7557]: pam_sss(kde:auth): User info message: Please insert smart card labeled
                                                    Orion Poplawski
kcheckpass[7557]: pam_sss(kde:auth): authentication success; logname=orion uid=22603 euid=22603 tty=:0 ruser= rhost= user=orion

sssd.conf has:

[pam]
pam_cert_auth = True
# kscreensaver for EL7, kde for Fedora
pam_p11_allowed_services = +kscreensaver, +kde


Version-Release number of selected component (if applicable):
sssd-2.3.0-9.el8.x86_64


FWIW - authselect issue - https://github.com/authselect/authselect/issues/234