The latest version of Identity Management in Red Hat Enterprise Linux allows multiple authentication types for a user
The user can now authenticate either with a password or with 2-factor authentication.
Hosts and services can require a specific authentication method
By default all authentication methods are allowed
For critical hosts and services 2-factor authentication can be enforced
At login the prompting indicates that the user can either use a password or 2FA
If only the password is used for authentication ...
... access is granted to systems which allow all types of authentication ...
... but not to systems which require 2FA.
The credentials can be upgrade by switching on the screen-saver
Now access is granted to the critical system as well