su authentication for securid RSA

Hello,

/etc/pam.d/su use root password to escalate privilege but if we want
to integrate it with securID auth or multi factor auth when what would
be the approach (because root doesn't have RSA token) so how does user
supply their tokenID.