Enable MFA for (all) or newly connected services

[phavekes]

This issue is imported from pivotal - Originaly created at Nov 28, 2023 by andreklaver

An increasing amount of IdP's require MFA to be enabled by default. Create a setting to make sure that all (or new services) have MFA enabled. Disable MFA for specific services on request by the SCV only.

IdP's that have MFA enabled by default will have an SP Whitelist and Stepup list that is similar and thus long. You might want to invert the stepup list for IdPs that do so: list only services that do not have MFA enabled: !STEPUP.

[phavekes]

Probably better to work on the plan to require IdPs to use MFA for all SURFconext logins. (Thijs Kinkhorst - Mar 13, 2024)