OTP loginhandler

[Cantor, Scott]

> Is there any currently, or in near future, plans for a general OTP loginhandler?

Not in those exact terms. After 3.2.0 ships, we have to start working on a framework for running composite login flows. Assuming you mean OATH, that's a SFA method like Duo that has to be combined with a password step, and unlike Duo it's not proprietary, so including a TOTP (or less likely HOTP) flow in the box would make sense.

In practice, people don't use that sort of thing much. Convincing management to do for free what you can pay companies thousands of dollars to do sadly doesn't go the way you think it would.
 
> If not them I would like some tips and tricks before I start developing one myself.

I don't have any documentation on writing login flows. We have several already implemented, the SPNEGO flow is coming shortly, and there's always using External to implement the new logic in a servlet.
 
> I am mostly interested in the loginhandler itself as the infrastructure behind
> it is relatively simple.

Writing login flows is quite simple, and writing servlets using the External interface is simpler.

-- Scott