MFA flow and "forced" Duo signup

[Cantor, Scott]

> I think you need to set "idp.authn.favorSSO = false" in idp.properties so that the
> MFA flow will be run everytime.  Otherwise, the IDP will "prefer"
> an existing SSO session.

It's a workaround described in the documentation.

https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ReuseoftheEntireauthn/MFAFlowResult(WhenIsaMFANextFlowStrategyExecuted?)

-- Scott