I'm looking at the Shib2 "Duo 2FA On Demand" article: https://wiki.shibboleth.net/confluence/x/ZACt ... and trying to translate that to Shib3 (which I confess is still mostly a dark art to me). Has anyone built an IdPv3 config that implements per-SP opt-in by requesting an alternate transport name? -- Jorj