Alexander,
Thank you for your prompt and informative answer, it cleared my last doubts. Two other
questions come to my mind:
1. Is it possible to enforce two-step auth for AD users (first step being AD
authentication, second OTP used by freeipa)?
2. Except kerberos-based MFA are there any other ways to achieve this goal (AD users being
able to log on Linux machines with 2FA)? Things like PBIS use something, I guess?
Couldn't something similar be used here?
Regards
M.