My /etc/pam.d/common-auth file is as follows: auth required pam_env.so auth [success=1 default=ignore] pam_localuser.so auth [success=1 default=ignore] pam_sss.so auth requisite pam_unix.so auth [success=1 default=ignore] /lib64/security/pam_duo.so ...

I know this is old but we are having the exact same issue. Deb9 works fine with our config but Deb10 does not and shows the same behavior the OP reports. Any ideas?