Distributed generation of random integers with prescribed sum

While reading this document I came across the following problem. Assume you have $$n$$ clients. The clients need to generate random integers in $$\mathbb{Z}_p$$, say $$T_i$$ for $$i \in \{1, \ldots, n\}$$, such that $$\sum_{i=1}^n T_i = 0$$ in $$\mathbb{Z}_p$$. This integers are then used as secret keys, so if $$n-2$$ clients cooperate, they still should not be able to obtain the secret key of the other two.

This is a bit modified version of the problem appearing in this document (page 15) in SetUp procedure. There it is not explained how to do it.

The closest answer to this question I found is in this document (section 6.1), but is not exactly what I am searching for. Is there a known solution I am missing?

• I've seen this referred to as pseudorandom zero sharing here and here. Though in those it was done in the shamir secret sharing scheme. – mikeazo Nov 5 '18 at 13:34