Here is a writeup of a project to implement KDC-side OTP support by delegating to a RADIUS server: http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS Comments are appreciated.