server default {
    authorize {
        if (State) {
            update control { Auth-Type := OTP }
        } else {
            ldap
            if (!ok) { reject }
            check_ldap_password
            if (!ok) { reject }
            update reply {
                State := "0x%{randstr:aaaaaaaaaaaaaaa}"
                Reply-Message := "Enter TOTP:"
            }
            update control { Auth-Type := OTP }
            challenge
        }
    }
    authenticate {
        Auth-Type OTP {
            validate_otp
            if (!ok) { reject }
            ok
        }
    }
}
