In ODC, account creation and recover password already support 2FA.

Introduce a 2FA state between credential validation and session creation, exposed through CreateAuthenticationChallenge() and CompleteLogin() APIs.

CreateAuthenticationChallenge(
    Username,
    Password
) 

Returns OTP

CompleteLogin(    

    Username,
    Password, 
    ChallengeToken
) 

This would allow support for several 2FA flows with the built-in IdP.