Shibboleth IdP 3.3.1 MFA with external authentication system

[fai at defilippo.org]

Hello,

I'm configuring Shibboleth Identity Provider version 3.3.1 to implement a SAML authentication flow with an external MFA system.

## Requirements

1. Service Provider (google.com) sends a SAML authentication request to Shibboleth IdP
2. Shibboleth IdP receives the request and should redirect it to mfa.lan for two-factor authentication  
3. Shibboleth IdP should accept authentication requests/responses from mfa.lan via SAML
4. Once mfa.lan returns a positive response, it will redirect the original request back to Shibboleth
5. Shibboleth IdP should respond to google.com with the successful SAML response

## Questions

- What is the recommended approach for this "proxy" flow in Shibboleth IdP 3.3.1?
- Should I use the External Authentication flow or MFA flow?
- How do I configure the IdP to accept authentication results from an external SAML IdP?
- Any configuration examples or documentation links would be greatly appreciated.

Thank you in advance!