Hi all,

We started looking into OTP features provided by IPA in our facility. In our environment, majority of our machines are located in the private network, users access them via external-facing Gateways. We want to enforce MFA on our gateway and allow users to have freedom SSH-ing into any internal nodes using their regular passwords (or keys). Then add HBAC rules for certain hosts/services who require MFA authentications using OTP (for example, protected web resource access. NX etc)  In order to achieve that, it seems to me we need turn on both 'password' and 'otp' for individual users or globally. This will then trigger 'password' for SSH and 'otp' auth for WebApps/NX and so on.

However when I looked at the online document @ https://www.freeipa.org/page/V4/OTP#Implementation , it stated "Mixing the "password" and "otp" user auth types should not be used", I wonder why "mixing" is not recommended, and what is the downside if we implement this way(in order to achieve what we're trying to do), or any other better strategies in this case?

Can some advice? Thank you in advance!
Mizuki