Some of our campus service providers have approached us asking for a way to allow users to opt-in to 2fa on a service-by-service basis (for services that would not normally require it). We're just starting to have this conversation, and I'm looking for ideas or suggestions as to how one might implement this using shibboleth. So.. any ideas? Liam