Another update: I have documentation drafted now so anybody that's interested should be able to play with this if you're running 3.3-SNAPSHOT. https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration We are still months from releasing this, so there is plenty of time for anybody to test this that's interested. -- Scott