It seem I don't have these logs:
[root@master ~]# systemctl list-units | grep ipa
ipa-custodia.service loaded active running IPA Custodia Service
ipa-dnskeysyncd.service loaded active running IPA key daemon
ipa.service loaded active exited Identity, Policy, Audit
ipa-otpd.socket loaded active listening ipa-otpd socket
ipa-ccache-sweep.timer loaded active elapsed Remove Expired Kerberos Credential Caches
[root@master ~]# systemctl status ipa-otpd.socket
● ipa-otpd.socket - ipa-otpd socket
Loaded: loaded (/usr/lib/systemd/system/ipa-otpd.socket; disabled; vendor preset: disabled)
Active: active (listening) since Wed 2022-11-16 17:32:04 CET; 4h 4min ago
Until: Wed 2022-11-16 17:32:04 CET; 4h 4min ago
Listen: /run/krb5kdc/DEFAULT.socket (Stream)
Accepted: 0; Connected: 0;
CGroup: /system.slice/ipa-otpd.socket
Nov 16 17:32:04 master.idm.cmcc.scc systemd[1]: Listening on ipa-otpd socket.
[root@master ~]# journalctl -xeu ipa-otpd
~
~
Where can I check?
In any case, is it right to insert as first factor the password of user defined in ipa and as second factor the password defined in radius?
Looking radius logs, it seems it didn't receive communication from ipa server (client radius).
Thanks