Enable MFA/DUO on per SP ?

[Cantor, Scott]

Conceptually, the point is...you want the IdP to decide whether to reuse the previous result(s) based on whether they already meet the SP's requirements, and if not, run the flow and then decide within the flow whether to run Duo based on whether the Password result meets the requirements or not.

None of this is based on the service, it's based on the requirements for authentication policy that may apply to any service.

The shipped examples already illustrate this (with IPAddress and Password instead of Password and Duo).

See also, the HowTo article in the KB about supporting REFEDS MFA.

Things are only complex if you also have to take into consideration other factors such as the user or a group the user is in. That requires more complex scripting but you start from the baseline.

-- Scott