[Freeipa-users] interesting Kerberos issue

[Janelle]

Ok, let me ask this a different way, because maybe there is a way, and I am just not seeing it.

I have 2 datacenters with typical bastions in each. I have enabled OTP and that works fine via ssh. But the user has to login to both and opening ssh tunnels is problematic at best.

Using all the creativity in this list, maybe someone knows of another way to have a user authenticate from a Mac where they would only have to do it once to get their ticket?

I guess I can't think of anything, but no harm in asking.

:)
~J