Piloting config changes

[Cantor, Scott]

> Would cookies be an option? Is there an obvious thing that
> I'm missing with URL that control where we would provide
> the auth (via our LDAP/Duo flow or our Azure flow)?

You would use  a post-login interceptor (likely using the External option to script something in JSP) to take the identity after authentication, check the group,  drop the cookie, and then implement logic in the MFA flow to check for the cookie to know what flow to run.

The opt-in could probably also be done in the MFA flow itself before it completes.

-- Scott