Duo login for shibboleth

[Cantor, Scott]

> They're all iframe based.

And serously flawed, in that the DuoWeb interface lies to the IdP when it relies on geolocation bypass rules on the Duo side, or similar bypass logic.

The AuthAPI does report this accurately, but would require re-implementing the iframe UI.

We're planning to push for that to get fixed; if there are other campuses concerned about this, you can contact me offline so we could gang up.

-- Scott