2nd factor IdP AuthN conditional on user attribute

[Cantor, Scott]

> Some users will have Yubikeys for U2F and others won’t.  What is the
> recommended path for making 2nd factor conditional on, say, membership in
> a pilot group or a Boolean flag indicating pilot user or not.  Is there a
> straightforward way to set this up in Shib IdP 3.2.1 (upgrade to 3.3 is on the
> roadmap)?

It is not straightforward, it's very complex and brittle to do it and is entirely not worth the time or trouble. Just upgrade, now.

-- Scott