Is it possible to enforce the second factor for a user only when trying
to login to specific hosts/host groups?
List here says yes...
https://blog.delouw.ch/2016/10/16/freeipa-selective-2fa-authentication-in...
I'm gonna give it a try.
Cheers,
Ronald