http://it.isevil.org/blog/2011/11/13/authentication-service-...
Code: https://github.com/bithive/example-totp-vault
For FreeRADIUS we use rlm_perl to define our own authenticate() method; it just calls the web service to validate the codes.