I'm sorry, I missed this warning because I was reviewing the patch on a machine that ran krb5 1.10. When I compiled master on a machine with krb5 1.11 I saw this warning:
/home/remote/jhrozek/devel/sssd/src/providers/krb5/krb5_child.c: In function ‘answer_otp’: /home/remote/jhrozek/devel/sssd/src/providers/krb5/krb5_child.c:303:5: warning: passing argument 1 of ‘sss_authtok_get_password’ from incompatible pointer type [enabled by default] In file included from /home/remote/jhrozek/devel/sssd/src/providers/data_provider.h:44:0, from /home/remote/jhrozek/devel/sssd/src/providers/dp_backend.h:25, from /home/remote/jhrozek/devel/sssd/src/providers/krb5/krb5_child.c:36: /home/remote/jhrozek/devel/sssd/src/util/authtok.h:70:9: note: expected ‘struct sss_auth_token *’ but argument is of type ‘struct sss_auth_token **’
The attached patch fixes that.