Hi,
There are many ways to do this. You can use group-alias with group-lock
feature to make sure that certain users can use certain profiles only. They
won't be able to login with other profiles (even with valid creds). But you
need to make sure that you have a unique parameter for the same group of
users such as memberOf
Another way of doing this using certificate-maps if you use cert
authentication to match parameters from the client cert and automatically
assign the designated profile. This way users don't get the option to
select a profile.
Sharing the same 2FA will not have an impact.
Here are some examples of group-lock with local auth but the same can be
applied to AD login with ldap-attribute map.
**** please remember to rate useful posts
