pam_sm_authenticate function should know from the tacacs exchange that tacacs server is requesting a new password.  If authentication is not from an interactive terminal then we need to return an appropriate error code like PAM_NEW_AUTHTOK_REQD.  If we're on an interactive terminal we can just carry on with the interactive password change through the use of PAM conversation function.
For these purposes non interactive terminal is tty=http