[Freeipa-users] OTP vs sudo

[Bendl, Kurt]

I'm planning our implementation of IdM/IPA, and I'm unclear about how I can implement IPA's OTP for  privileged access.

I need to be able to set up systems so:
 * accounts can auth using traditional userid/password
 * privileged access (sudo) requires OTP

We've done some testing, injecting a 3rd party OTP solution (PrivacyIDEA) into the mix. This seems to work. But, if I can make IPA's built-in mojo work, I'd prefer to keep it all in the family.

Thanks,
  Kurt