FreeIPA OTP tokens with TOTP, HOTP and YubiKeys
Rolling out FreeIPA two-factor authentication with software TOTP apps and hardware tokens such as YubiKeys: enabling OTP per user or globally, token enrollment, and recovery when tokens are lost.
FreeIPA MFA and smart cards
Strong authentication in FreeIPA: OTP tokens, RADIUS proxying, smart cards and certificate mapping, authentication indicators and the Kerberos settings MFA depends on.
FreeIPA RADIUS proxy for existing OTP systems
Keeping an existing commercial OTP or RADIUS system while moving identity to FreeIPA: RADIUS proxy configuration, per-user assignment, FIPS limits and a gradual migration path.
FreeIPA smart card authentication
Configuring FreeIPA servers and clients for smart card login: ipa-advise scripts, storing certificates or mapping data on user entries, GDM and su login, and Web UI smart card login quirks with TLS 1.3.
FreeIPA certificate mapping rules
Matching smart card certificates to FreeIPA users without storing full certificates: matching and mapping rules, domain lists, priorities, and the KDC cache delay after changes.
Smart card login for AD users through a FreeIPA trust
Letting Active Directory users log in to Linux with smart cards issued by AD Certificate Services through a FreeIPA trust, and the mapping and trust settings it needs.
Enforcing MFA per service with FreeIPA authentication indicators
Requiring OTP, smart card or external IdP authentication for specific services in FreeIPA with authentication indicators, ticket policy per mechanism, and the core services you must not restrict.
Offline OTP login with SSSD
Making OTP-protected logins work on laptops that go offline: the online first-login requirement, separate password and OTP entry, cache settings and minimum password length.
Kerberos FAST and two-factor authentication in FreeIPA
Why FreeIPA two-factor authentication depends on Kerberos FAST, what breaks when FAST is disabled for AD trusts, and how to keep MFA working in mixed environments.
