[Freeipa-users] Re: Require OTP for ipa commands

[David Harvey]

On Fri, 19 Mar 2021 at 15:46, David Harvey <davidcharvey(a)googlemail.com&gt;
wrote:

>  Hello again list,
>
>  Is it possible to differentiate between a kerberos ticket that was granted
>  with OTP vs one that would not (for the purpose of requiring it for `ipa
>  some-privileged command` )
>
>  Aim: Protect servers with OTP but not always require it for workstations.
>  But to require OTP for the privilege that ipa commands
>  afford powerful users from their workstation.
>
>  Other potential avenues (full admission - less research performed) - I'd
>  be interested in would be periodic requirements for OTP, but not for say
>  screen unlock events.
>  
I assume nothing has changed on this since "[Freeipa-users] different
security policy for login(password+otp) and screenlock (password only) for
workstation"

>  Thanks as always,
>
>  David
>