In list (-l) or verify (-v) mode, if we have a match but authentication

is required, clear FLAG_NOPASSWD so that when listpw/verifypw is
set to "all" and there are multiple sudoers sources a password will
be required unless none of the entries in all sources require
authentication.  From Radovan Sroka of RedHat

plugins/sudoers/sssd.c

@@ -1342,6 +1342,8 @@ sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag)
 		case any:
 		    if (doauth == false)
 			SET(ret, FLAG_NOPASSWD);
+		    else
+			CLR(ret, FLAG_NOPASSWD);
 		    break;
 		default:
 		    break;