Pre-Authentication Sets

[Nathaniel McCallum]

So we've been able to push the first release of AuthHub
(https://fedorahosted.org/AuthHub) out the door. And from here we'd like
to look a bit at our path ahead.

One of the things that is an important priority for us is the ability to
require both the kerberos password and an OTP token. We've mentioned
this in passing previously, and the response was that the KDC needs to
support pre-authentication sets, or the ability to require specific
pre-authentication mechanisms for a given authentication to succeed.

Is there a plan for pre-authentication sets in 1.11? What precisely
needs to be done in order to get this? Is there perhaps something we can
do as a temporary workaround?

Thanks!

Nathaniel