add authentication authnProfile OTP_AAA -authnVsName Auth_AAA add authentication ldapAction OTP_SLDAP -serverIP xxx.xxx.xxx.xxx-serverPort 636 -ldapBase "dc=company,dc=com" -ldapBindDn serviceaccountname -ldapBindDnPassword ################################### -encrypted -encryptmethod ENCMTHD_3 -ldapLoginName sAMAccountName -secType SSL add authentication ldapAction OTP_Register_Device -serverIP xxx.xxx.xxx.xxx -serverPort 636 -ldapBase "dc=company,dc=com" -ldapBindDn serviceaccountname -ldapBindDnPassword ############################################## -encrypted -encryptmethod ENCMTHD_3 -ldapLoginName sAMAccountName -groupAttrName memberOf -subAttributeName cn -secType SSL -authentication DISABLED -OTPSecret extensionAttribute15 add authentication ldapAction SLDAP_OTPAuth -serverIP xxx.xxx.xxx.xxx -serverPort 636 -ldapBase "dc=company,dc=com" -ldapBindDn serviceaccountname -ldapBindDnPassword ############################################ -encrypted -encryptmethod ENCMTHD_3 -ldapLoginName sAMAccountName -searchFilter "extensionAttribute15>=#@" -groupAttrName memberOf -subAttributeName cn -secType SSL -authentication DISABLED -OTPSecret extensionAttribute15 add authentication loginSchema SinglePasswordForManageOTP -authenticationSchema "/nsconfig/loginschema/LoginSchema/SingleAuthManageOTP.xml" add authentication loginSchema OTPPushOrPasscode -authenticationSchema "/nsconfig/loginschema/LoginSchema/DualAuth.xml" -passwordCredentialIndex 1 -SSOCredentials YES add vpn trafficAction Traffic_Profile http -passwdExpression "AAA.USER.ATTRIBUTE(1)" add vpn trafficPolicy OTP_Traffic_Policy true Traffic_Profile set ssl vserver Auth_AAA -ssl3 DISABLED -tls1 DISABLED -tls11 DISABLED -tls13 ENABLED -dtls1 DISABLED add authentication Policy LDAPAdv -rule "http.req.cookie.value(\"NSC_TASS\").eq(\"manageotp\") && client.IP.SRC.IN_SUBNET(xxx.xxx.xxx.xxx/8)" -action NO_AUTHN add authentication Policy SelectManageDevices -rule "http.req.cookie.value(\"NSC_TASS\").eq(\"manageotp\") && client.IP.SRC.IN_SUBNET(xxx.xxx.xxx.xxx/8)" -action NO_AUTHN add authentication Policy SelectOTPAuthentication -rule true -action NO_AUTHN add authentication Policy LDAPAuthn -rule true -action OTP_SLDAP add authentication Policy OTPRegisterDevice -rule true -action OTP_Register_Device add authentication Policy LDAPOTPAuthentication -rule true -action SLDAP_OTPAuth add authentication Policy _OTP_Auth_AAA_OPTManageOrAuthenticate__root_0 -rule true -action NO_AUTHN add authentication policylabel OPTManageOrAuthenticate__root -loginSchema LSCHEMA_INT add authentication policylabel AuthenticateToManageDevices__OPTManageOrAuthenticate -loginSchema SinglePasswordForManageOTP add authentication policylabel OTPDeviceRegistration__OPTManageOrAuthenticate -loginSchema LSCHEMA_INT add authentication policylabel OTPAuthentication__OPTManageOrAuthenticate -loginSchema OTPPushOrPasscode add authentication policylabel OTPPushOrPasscode__OPTManageOrAuthenticate -loginSchema LSCHEMA_INT bind authentication policylabel OPTManageOrAuthenticate__root -policyName SelectManageDevices -priority 100 -gotoPriorityExpression NEXT -nextFactor AuthenticateToManageDevices__OPTManageOrAuthenticate bind authentication policylabel OPTManageOrAuthenticate__root -policyName SelectOTPAuthentication -priority 110 -gotoPriorityExpression NEXT -nextFactor OTPAuthentication__OPTManageOrAuthenticate bind authentication policylabel AuthenticateToManageDevices__OPTManageOrAuthenticate -policyName LDAPAuthn -priority 100 -gotoPriorityExpression NEXT -nextFactor OTPDeviceRegistration__OPTManageOrAuthenticate bind authentication policylabel OTPDeviceRegistration__OPTManageOrAuthenticate -policyName OTPRegisterDevice -priority 100 -gotoPriorityExpression NEXT bind authentication policylabel OTPAuthentication__OPTManageOrAuthenticate -policyName LDAPAuthn -priority 100 -gotoPriorityExpression NEXT -nextFactor OTPPushOrPasscode__OPTManageOrAuthenticate bind authentication policylabel OTPPushOrPasscode__OPTManageOrAuthenticate -policyName LDAPOTPAuthentication -priority 100 -gotoPriorityExpression NEXT bind authentication vserver OTP_Auth_AAA -policy _cacheTCVPNStaticObjects -priority 10 -gotoPriorityExpression END -type REQUEST -devno 486539264 bind authentication vserver OTP_Auth_AAA -policy _cacheOCVPNStaticObjects -priority 20 -gotoPriorityExpression END -type REQUEST -devno 486539264 bind authentication vserver OTP_Auth_AAA -policy _cacheVPNStaticObjects -priority 30 -gotoPriorityExpression END -type REQUEST -devno 486539264 bind authentication vserver OTP_Auth_AAA -policy _mayNoCacheReq -priority 40 -gotoPriorityExpression END -type REQUEST -devno 486539264 bind authentication vserver OTP_Auth_AAA -policy _cacheWFStaticObjects -priority 10 -gotoPriorityExpression END -type RESPONSE -devno 486539264 bind authentication vserver OTP_Auth_AAA -policy _noCacheRest -priority 20 -gotoPriorityExpression END -type RESPONSE -devno 486539264 bind authentication vserver OTP_Auth_AAA -policy _OTP_Auth_AAA_OPTManageOrAuthenticate__root_0 -priority 100 -nextFactor OPTManageOrAuthenticate__root -gotoPriorityExpression NEXT -devno 536870912

That would use nfactor to check if user was internal or external by subnet, and then push user to OTP, the helpdesk would set the user up by appending the /manageotp for device registration

and the OTP would use attribute15 in AD LDAP on the user account to store the secret key

I would try editing the otp schema with those settings and applying to the vip, and see if that works, I haven't tried that myself