SimpleSAMLphp is quite straightforward; use the Yubikey auth source and you get their 2FA very easily. SAML2 will never be quite as easy to configure as OpenID in practice, but it&#x27;s the least painful setup I&#x27;ve seen. (Yes, I include several of the big commercial authentication-as-a-service vendors in that comparison.)<p>Having the ability to easily manipulate attributes at a per-SP level makes integrating with semi-broken vendor implementations much more practical. There are modules available to add OpenID and OAuth; I use the OpenID module in production and have been quite happy with it.