[Samba] 2-factor authentication

[Sketch]

We've had a Samba 4 AD domain for nearly a year now, and things work 
great.  However, now it appears we are going to have to set up 2-factor 
authentication.  Does anyone have any suggestion for products or (even 
better) open source solutions that will work with Samba 4 DC's? 
Preferably ones that don't require unencrypted user passwords, but I 
suppose I'll take what I can get...

Thanks.