@alcinnz The best way to handle authentication I've found is using the Kanidm identity provider (https://kanidm.com), which encourages passwordless authentication and has no requirement for passwords, TOTP, nor email. It supports passwords and TOTP as fallback authentication methods, but those can be disabled per user group by the system administrator. By default, it requires either Webauthn or a combination of password + TOTP.