Using Duo for per-SP-opt-in

[Jorj Bauer]

> Here's doc on getting v3 to handle like v2 did when the MCB was installed and setup.  It talks about how to get the duo opt-in stuff to work.
>
> https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=22151311

Thanks Dave. On the face of it that talks through per-user opt-in, where 
I want per-SP. I'll spend some time reading through it to see how close 
it gets.

Specifically I'm looking for the analog of an SP being able to set 
forceAuth="true", but for 2f.

The SP knows what the sensitivity of its data is; the decision of 
whether or not it is requiring specific types of identity assurance 
related to the remote user should also be decided by the SP and not the 
IdP. (Preferably, as Scott points out, as well-defined LoA decisions 
rather than specific technologies - but today I'm working at layer 7 
instead of 8.)

The documentation of how to do that with Shibv2 looks to have done 
exactly what I'm looking for, and I'm hoping to reproduce it in v3.

-- Jorj