Charles Hedrick via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
I’d like to avoid having to use a second cache to armor 2FA
requests. My impression was that SPAKE was supposed to fix this. I
just installed a new kdc (replica of an old one) in Centos 8. It
understands SPAKE, offering it as preauthebtication for normal
users. But a user with 2FA is not offered SPAKE preach. I still have
to use FAST.
Have I misunderstood, or is extra configuration needed?
SPAKE is a variant preauthentication mechanism for acquiring TGTs. It
is fully supported in el8. However, what you're looking for is an
appropriate 2FA mechanism - currently none of those have been created
yet.
What you're after is a planned future goal (but requires me to have more
time to work on it :) ).
Thanks,
--Robbie