diff --git a/daemons/ipa-otpd/internal.h b/daemons/ipa-otpd/internal.h
index 9b2f21ea7..5f768d4f9 100644
--- a/daemons/ipa-otpd/internal.h
+++ b/daemons/ipa-otpd/internal.h
@@ -166,6 +166,9 @@ void otpd_log_err_(const char * const file, int line, krb5_error_code code,
 int add_krad_attr_to_set(krad_packet *req, krad_attrset *attrset,
                          krb5_data *datap, krad_attr attr, const char *message);
 
+int get_krad_attr_from_packet(const krad_packet *rres,
+                              krad_attr attr, krb5_data *_data);
+
 int get_string(LDAP *ldp, LDAPMessage *entry, const char *name,
                char **out);
 
diff --git a/daemons/ipa-otpd/main.c b/daemons/ipa-otpd/main.c
index 812461574..ebee31678 100644
--- a/daemons/ipa-otpd/main.c
+++ b/daemons/ipa-otpd/main.c
@@ -113,6 +113,55 @@ int add_krad_attr_to_set(krad_packet *req, krad_attrset *attrset,
     return ret;
 }
 
+/* Most attributes have limited length (MAX_ATTRSIZE). In order to accept longer
+ * values, we will concatenate all the attribute values to single krb5_data. */
+int get_krad_attr_from_packet(const krad_packet *rres,
+                              krad_attr attr, krb5_data *_data)
+{
+    const krb5_data *rmsg;
+    krb5_data data = {0};
+    unsigned int memindex;
+    unsigned int i;
+
+    i = 0;
+    do {
+        rmsg = krad_packet_get_attr(rres, attr, i);
+        if (rmsg != NULL) {
+            data.length += rmsg->length;
+        }
+        i++;
+    } while (rmsg != NULL);
+
+    if (data.length == 0) {
+        return ENOENT;
+    }
+
+    data.data = malloc(data.length);
+    if (data.data == NULL) {
+        return ENOMEM;
+    }
+
+    i = 0;
+    memindex = 0;
+    do {
+        rmsg = krad_packet_get_attr(rres, attr, i);
+        if (rmsg != NULL) {
+            memcpy(&data.data[memindex], rmsg->data, rmsg->length);
+            memindex += rmsg->length;
+        }
+        i++;
+    } while (rmsg != NULL);
+
+    if (memindex != data.length) {
+        free(data.data);
+        return ERANGE;
+    }
+
+    *_data = data;
+
+    return 0;
+}
+
 static void on_ldap_free(verto_ctx *vctx, verto_ev *ev)
 {
     (void)vctx; /* Unused */
diff --git a/daemons/ipa-otpd/oauth2.c b/daemons/ipa-otpd/oauth2.c
index 2bba33703..a33cf5171 100644
--- a/daemons/ipa-otpd/oauth2.c
+++ b/daemons/ipa-otpd/oauth2.c
@@ -135,55 +135,6 @@ static void oauth2_on_child_writable(verto_ctx *vctx, verto_ev *ev)
     verto_del(ev);
 }
 
-/* Most attributes have limited length (MAX_ATTRSIZE). In order to accept longer
- * values, we will concatenate all the attribute values to single krb5_data. */
-static int get_krad_attr_from_packet(const krad_packet *rres,
-                                     krad_attr attr, krb5_data *_data)
-{
-    const krb5_data *rmsg;
-    krb5_data data = {0};
-    unsigned int memindex;
-    unsigned int i;
-
-    i = 0;
-    do {
-        rmsg = krad_packet_get_attr(rres, attr, i);
-        if (rmsg != NULL) {
-            data.length += rmsg->length;
-        }
-        i++;
-    } while (rmsg != NULL);
-
-    if (data.length == 0) {
-        return ENOENT;
-    }
-
-    data.data = malloc(data.length);
-    if (data.data == NULL) {
-        return ENOMEM;
-    }
-
-    i = 0;
-    memindex = 0;
-    do {
-        rmsg = krad_packet_get_attr(rres, attr, i);
-        if (rmsg != NULL) {
-            memcpy(&data.data[memindex], rmsg->data, rmsg->length);
-            memindex += rmsg->length;
-        }
-        i++;
-    } while (rmsg != NULL);
-
-    if (memindex != data.length) {
-        free(data.data);
-        return ERANGE;
-    }
-
-    *_data = data;
-
-    return 0;
-}
-
 /* oidc_child will return two lines.
  * The first is a JSON formatted string containing the device code and other
  * data needed to get the access token in the second round. This will be