Duo login for shibboleth

[Cantor, Scott]

> You could, however, flip
> this request around and setup multiple Duo webSDK integrations with your
> IdP.  That way you could have a context for "anything duo supports" vs one
> for "anything except phone, trusted devices, and trusted networks".  You'd
> then have the information you needed about what the user did (or didn't do)
> when they performed the additional factor.

That's a bit of the long way around, but I guess so, yes. I'm working on what will eventually be the canonical way of integrating this into 3.3 and the code I started with had support for multiple Duo configs, probably that needs to be folded back in and I need to think about applying the tricks I used with JAAS. The JAAS validators can be told to map specific JAAS configs to specific Principal collections, this is basically the same idea. Thx for the suggestion.

-- Scott