2FA-Horizon PAM configuration for FreeRADIUS (Centos 7) edit /etc/pam.d/radiusd This parameters give you passcode based Google Authenticator without AD password, Then you get the traditional Horizon AD credential prompt.