Using Duo for per-SP-opt-in

[Jorj Bauer]

>> Specifically I'm looking for the analog of an SP being able to set
>> forceAuth="true", but for 2f.
>
> In before Eric: ForceAuthn is different.
>
> An SP requiring a context class says "SSO via a cookie is fine, but make sure initial authentication was done in X manner".
>
> ForceAuthn says "mumble, florp, garble". No, but seriously, it says something about "please don't do SSO but I can't really say exactly what that means", and with Duo it isn't really established practice what it means. Might mean do both factors again, might mean at least one, etc.

Fair enough, and good to know. I was citing the concept rather than the 
practice, which you probably guessed.

-- Jorj