Shibboleth MFA questions

[s-awinte at haw-landshut.de]

Dear Shibboleth team and fellow users,

I'd like to get your opinion and hints on using MFA-flow with x509Authn
and U2F with pw + uname + Yubikey via plugin (which we're using already):
GitHub - Ratler/shibboleth-mfa-u2f-auth: U2F multifactor authentication
plugin for Shibboleth IdPv3
<https://github.com/Ratler/shibboleth-mfa-u2f-auth>

To my understanding, Shibboleth 3.x offers all availible authn methods
to the SP and will fall back to flows, as defined in the configuration,
e. g.:
U2F -> x509Authn -> fail

I've heard two contradictionary statements on if IdP or the SP controls,
which flow is actually triggered, i. e. if it's explicitly requested by
SP, or if IdP offers and SP accepts this authn method.

I couldn't find much information in the docs on how to set up the
configuration for the specific combination above, though - only MFA-flow 

Currently, my colleagues and I are using U2F-flow with the U2F-plugin.
The developer stated, that there's a programmatical approach required, a
plugin for IdP, Javascript or a Java bean of sorts, to manage the
x509Authn-flow, i. e. deactivating the U2F-plugin (there's supposed to
be an API switch for that) and extracting user principal or SAN from the
client cert information provided from the env vars of Apache. I've taken
care of the Apache configuration to set the client cert information in
the env vars already.

As I've learned, Shibboleth 3.x implements a MFA-flow compatible
x509-Authn flow already, which is configured in x509-authn-config.xml.
but it's not supposed to work with U2F via Yubikey (or other plugins)
out-of-the-box.

Does someone have any experience and thought on this kind of setup, even
better, some real life configuration examples for SP and x509-Authn flow
of sorts, or hints on how to approach the problem of controlling
uname/principal extraction and plugins programmatically, as described?

Best regards,
Armin