Is there a built in/supported means of bypassing 2fa for non-kerberized services?
I'm in the last stages of migrating away from Active Directory, but have a few systems
that do not integrate well with 2fa because they do not cache credentials in any useful
form:
* Our enterprise WiFi (would prompt for a new credential every time the device roams to a
new AP)
* Our Jabber IM service (would prompt for a password every time the computer wakes from
sleep)
* Our IMAP mail service (would prompt for a password every time the connection drops due
to idle)
I know Google use application specific passwords to mitigate this (
https://support.google.com/mail/answer/185833?hl=en ), which would be better than
bypassing 2fa but I don't believe there's a mechanism to do this built into
FreeIPA.
Any suggestions on how I could handle these services?
Many thanks,
Adam Bishop