Re: [Freeipa-users] Fwd: 2-Factor and services

2015-03-02 Thread Dmitri Pal
On 03/02/2015 01:19 AM, Michael Lasevich wrote: There is actually a way to achieve what you most likely want to but not what you are asking for. I do not think there is currently a way to force 2fa based on service or host being authenticated - it is all or nothing. However, if all you want

Re: [Freeipa-users] Fwd: 2-Factor and services

2015-03-01 Thread Dmitri Pal
On 02/27/2015 11:37 AM, Matt Wells wrote: I see how that would work but as you mentioned, I no longer have SSO. My desktops are all 3. Linux, Mac and Windows however the Windows systems talk with AD and a trust exists to facilitate those communications and SSO between the systems. It doesn't

Re: [Freeipa-users] Fwd: 2-Factor and services

2015-02-27 Thread Matt Wells
I see how that would work but as you mentioned, I no longer have SSO. My desktops are all 3. Linux, Mac and Windows however the Windows systems talk with AD and a trust exists to facilitate those communications and SSO between the systems. It doesn't sound like this is really possible without

Re: [Freeipa-users] Fwd: 2-Factor and services

2015-02-26 Thread Dmitri Pal
On 02/26/2015 12:40 PM, Matt Wells wrote: Had an error on my options for the list and the replies failed to get to me. We'll see if this reply works. :) @Dmitri - Anyone coming through this service/host (OpenVPN with pam) will be required to use 2-Factor. Their normal logins at their desk are