[Freeipa-users] Host based 2FA ?

[freeipa at pettyvices.com]

I'd like to be able to require 2FA on *certain* hosts and allow just 
passwords on others.

It seems you can check both "passwords" and "2FA" under the user.

I was hoping I could create a HBAC such that certain hosts would only 
allow 2FA, but I can't see an obvious way to do that.

Is it possible?  Help on how would be great.  If not, feature request?

thanks,

-t