Using Duo for per-SP-opt-in

[Cantor, Scott]

> I've not looked closely at the Duo-supplied implementation, but there is a
> very basic difference in the design goal between Duo's and Unicon's
> implementations. Duo's implementation assumes you want to send all users
> to Duo, and do all "gating" of who does and does not need to perform Duo
> based on your settings for that user in the Duo user registry. Unicon's
> implementation assumes you want to control who gets sent to Duo on the
> IdP side, based on factors like the SP's requested authn context, the default
> authn context for that SP, and the "attribute" that indicates which
> authentication flows a given user is allowed to use.

The user-level stuff would certainly be a difference, yeah. So far I think I've convinced people here to avoid that like the plague.

It is definitely possible to drive any login flow based on AuthnContext rules with no explicit support from the login flow itself though, that should work fine unless they did some really weird stuff that would be ill-advised. I'll probably peek at that one based on that information.

-- Scott