With Linux PAM you can chain authentication modules. Just set all the necessary PAM-module you want to be checked to
required in the appropriate configuration file.
From the documentation:
When a server invokes one of the six PAM primitives, PAM retrieves the
chain for the facility the primitive belongs to, and invokes each of
the modules listed in the chain, in the order they are listed, until
it reaches the end, or determines that no further processing is
necessary (either because a binding or sufficient module succeeded, or
because a requisite module failed.) The request is granted if and only
if at least one module was invoked, and all non-optional modules
So if all authentication methodes must be successful, use
requisite. However, if the first of two auth-methodes fails, it will terminate immediately.
If you want to hide the fact that some certain auth-methode failed, use
required. Even if one module fails, it will continue to check other methodes, just to fail at the end.
If you only need one of those methodes to succeed (means: many may fail, only one successful auth is sufficient), use
Refer to Pam Chain Policies for more details.