Authentication as endpoint check?

I need to have two factor (RADIUS and AD) authentication for users accessing one virtual host and one factor (AD only) authentication for users accessing another virtual host. It seems that the only way to have two-factor authentication is to enable secondary AD password authentication globally. This means that the logon page for all Master Groups (dynamically mapped from virtual host) will show two password fields, even if the Master Group has only one form of authentication configured.

 

 

I'm wondering if I can build a prelogon inspection to prompt for RADIUS password if the user comes in on a particular virtual host.

 

 

For instance, if a user goes to VirtualHostA then he gets a prompt for RADIUS authentication. On Success, he gets the normal FirePass logon page with one password field - using AD authentication. On Fail, he gets the Login Denied page.

 

 

If a user goes to VirtualHostB then he goes straight to normal FirePass logon page with one password field using AD authentication.

 

 

Has anyone had any experience with this?