Request for enhancement

As a user logging in with ssh to a FreeIPA enrolled host that does not require 2FA authentication, I should not be prompted for a "Second Factor (optional)"

As a user when I ssh to a FreeIPA enrolled host that requires 2FA authentication, I should not be prompted for "Second Factor (optional)" when it is not optional.

Issue

We have set up per host 2FA authentication with FreeIPA by:
- Enabling Two factor authentication (password + OTP) in the IPA server configuration
- Ticking OTP authentication indicator on those hosts we want 2FA to be enabled
- NO OTP AUTHENTICATION INDICATORS ON USERS OR OTHER HOSTS

We are getting a log of user complaints that the login prompts for the second factor are misleading. Their complaints come in two forms:
- States that the second factor is optional when it is required
- Requests a second factor when it is not required

This is probably an issue that will require co-ordinated changes with sssd https://pagure.io/SSSD/sssd/issue/3856

Steps to Reproduce

1. Set up per host 2FA as above
2. Create 2 test login hosts, and update sssd to 1.16.0 or later
3. Enroll the test hosts
4. Set the OTP auth indicator on one the test host. This is the 2FA test host
5. Add an OTP token to the login user
6. Log with 2FA to confirm 2FA works, see "Second Factor (optional)" when it is required
7. Log into the other test host and see "Second Factor (optional)"

Actual behavior

The prompt "Second Factor (optional)" appears everywhere regardless of the actual per host login requirements.

Expected behavior

On hosts that do not require 2FA users should only get a "Password" or "First Factor" prompt.
On hosts that require 2FA users should not be misinformed that the second factor is 'optional'

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server sssd

on a login node:
[root@login01 ~]# rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server sssd
package freeipa-server is not installed
package freeipa-client is not installed
package ipa-server is not installed
ipa-client-4.5.4-10.el7.centos.4.4.x86_64
package 389-ds-base is not installed
package pki-ca is not installed
package krb5-server is not installed
sssd-1.16.1-7.el7.centos.x86_64

On freeipa server:

[root@hpchipa06 ~]# rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server sssd
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.5.4-10.el7.centos.3.x86_64
ipa-client-4.5.4-10.el7.centos.3.x86_64
389-ds-base-1.3.7.5-24.el7_5.x86_64
pki-ca-10.5.1-13.1.el7_5.noarch
krb5-server-1.15.1-19.el7.x86_64
sssd-1.16.0-19.el7_5.5.x86_64

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting