I upgraded my shibboleth IdP from V2.4.4 to V3.3.1 everything works normally. I have the MFA configured to work with the internal DUO flow. My question is: Is there any way to set up DUO flow for specific SPs rather than having it enabled for all of them.
We're still on older 3.2.1, but I've just started down this research path as well. We have DUO working fine, but were asked to see if two factor can additionally be turned on/off for specific sites. I'll let you know if I get something working.