MIT uses a custom KDC pre-authentication module to integrate with Duo for two-factor authentication, which was developed by Mark and Garry. Garry has asked us to clean up the source code for this module so that it can be released as open source.
Some potential impediments:
The module is coded against the pre-1.10 private preauth interface, and would need to be migrated to the current stable interface.
We need a way to test the module to ensure that our refactoring work does not break it.