2nd factor IdP AuthN conditional on user attribute

[Cantor, Scott]

> shibboleth-mfa-u2f-auth appears to hook similar to Unicon's Duo
> plugin, rather than Duo's own competing plugin. So it might work as is
> with 3.3, but it's more at risk. (Duo's strategy was to sneakily
> intercept Password without actually adding to idp.authn.flows, so
> theirs works in 3.3.)

Unicon's should work, but there's some kind of issue involving the webflow config hooking that probably led to the need to screw with the web.xml file, and the approach in general has some assumptions that probably work but just aren't really kosher. It's mostly moot at this point since that functionality is already present in 3.3.

> If you already have shibboleth-mfa-u2f-auth working with 3.2.1 then it
> shouldn't be too hard to figure out how to switch the flow on or off
> based on what UChicago and others did with shib-mfa-duo-auth.

Far be it from me, if one thinks it's not too hard, have at it, it will still work. I don't share that opinion, so I'm just not going to try and help people do it anymore, if I ever did.

> - Make the existing shibboleth-mfa-u2f-auth work in 3.3.

To be clear, I would like to add U2F support to 3.4, but all of the token-based options have a problem in that we need a token registration API or a solution, one of the two. I don't think we have any hope of establishing an API, so that leaves a solution, and doing a full UI and back-end for managing tokens is not hard but is not trivial work.

> - Sponsor the possibly substantial work for the next version of
> shibboleth-mfa-u2f-auth, or a forked or from-scratch reimplementation
> by someone else, designed to work with the completely new MFA
> framework in 3.3. Unless you can switch to Duo this is the only viable
> long-term option, but the timing sucks.

The issue is token mgmt, not doing the authentication part. Doing a login flow that just does U2F is trivial, it's less work than any version prior to 3.3 would be because it can exclusively do nothing but that one thing. The MFA framework moves all of the hard parts to user-authored scripts, none of the business logic is inside the login methods at all and is of no relevance to the work.

-- Scott