So, https://goauthentik.io/ actually supports totp with ldap as well. https://docs.goauthentik.io/docs/providers/ldap#binding--bin...

And the parent makes a good point that OIDC/OAuth does not give group membership.