Bizarre behavior (SSO+MFA) asking for credentials on some servers, but with extra "specialness"

[Michael S. Moody]

Good evening,

First, thank you, again, for FreeIPA. I know I say it every time I send a
message to the list, but it's magic.

We're running into an interesting situation where some of our hosts are
requesting a first/second factor, even once authenticated.

Essentially, we SSH into a bastion host using MFA (PW+TOTP at the moment).
Once we're in, we're able to pretty reliably SSH to other hosts without
issue. However, we've got a few hosts that prompt for "First Factor/Second
Factor". We're able to authenticate against those hosts if we provide
credentials, but if we logout and log back in, we have to do it again.

Interestingly, there's a host we can SSH to (bastion01 to dev-server02)
which we can then SSH to another (dev-server02 to dev-server01) and not be
prompted for credentials, but if we attempt to authenticate against it
directly from the bastion host, we get prompted (bastion01 to dev-server01).

Similarly, we can hop onto other servers, no issues. I can SSH from a host
to another and then try to SSH again back (a circle) and get prompted
(bastion01 too dev-server02 to dev-server01 to bastion01) and it might
work, or it might not, depending on the host in question. It's the most
bizarre behavior I've ever seen with FreeIPA.

Any guidance that you can provide is appreciated.

Thanks in advance,
Michael S. Moody