We have several applications that leverage AD
- SAML (via Ping Federate)
- LDAP authentication from 3rd party applications
- Windows workstation / Exchange auth (Kerberos)
- IIS and web components (su4user, impersonation, etc)
I have never deployed 2 factor auth in an AD environment and remember reading that RADIUS was leveraged in a way to accommodate many if not all of the scenarios above, with minimal impact to the end users.
Can anyone explain the infrastructure that is needed for a private corporation to deploy 2FA to their AD Forest, and allow 3rd parties (such as Salesforce, Dropbox, Office 365) to leverage that authentication?