2nd factor IdP AuthN conditional on user attribute

[Cantor, Scott]

> Yes, the shibboleth-mfa-u2f-auth actually hooks into the webflow config,
> even though no modifications to web.xml is necessary for this plugin.

There really was no way to hook that config in 3.2, the only way to add a flow was to copy files into idp.home/flows and use the naming convention required. So anything not doing that is likely not going to work right in 3.3.

In 3.3, that user flow location still works, but plugins can also inject flows defined with the right convention from their jar classpath, as it should have been done originally.

> I'm going to rewrite the plugin to support the new MFA framework which
> seems to be the sensible thing to do here.

The framework really doesn't dictate how you do your part. It's for letting everybody *else* control how U2F is combined with other methods and when it's triggered, so you don't have to think about any of that. You just do U2F by itself, and you're done. If that's what your flow does now, you're probably 90% done.

> The current plugin uses Yubico
> U2Fval as a back-end, even if the plugin is easily extended to any kind of
> back-end. It still requires a token management UI (app) though. I have an
> experimental branch allowing registration through a webflow in the IdP
> (purely for testing), but in my opinion the IdP should not have the role of
> token management.

I don't really disagree, but the problem is our competitors *do* handle that role, so for us to not include that functionality means we're not providing a comparable feature and we're not giving people something they can really deploy.

Of course, I'm open to partnering on that piece, but it needs to be something open source and robust enough that we can clearly say "use that".

-- Scott