MIT Kerberos supports preauth with OTP, or PKINIT (X.509 certifies); I don't know what Heimdal currently has. FreeIPA has been doing good work past that, on in

MIT Kerberos supports preauth with OTP, or PKINIT (X.509 certifies); I don't know what Heimdal currently has. FreeIPA has been doing good work past that, on integrating FIDO, for instance, and can issue tickets on the basis of external identity providers. It certainly does more -- like a souped-up AD.