SSO MFA tracker

[Joerger]

Tracker issue for SSO MFA.

• RFD 180: SSO as MFA Method #44699
• Add second_factors #47233
  • Related: deprecate second_factor without removing it
    • Deprecate second factor off/optional (mostly consists of updating tests / adding backdoor via testing modules)
    • Update MFA Web login endpoint to support OTP, remove reliance on knowing second_factor in the client. Makes ^ simpler.
• feat: SSO MFA - Add Auth Connector MFA settings protobuf and methods. #46687
  • feat: SSO MFA - add missing SAML MFA fields #47291
• feat: SSO MFA - support for SAML ForceAuthn for login and mfa checks #46703
• feat: SSO MFA - support for OIDC MaxAge #47292
• feat: SSO MFA - Add ephemeral SSO MFA device #46704
• feat: SSO MFA - Add SSOMFASessionData #47647
• feat: SSO MFA - Add MFAToken to SSO Callback flow #47648
• https://github.com/gravitational/teleport.e/pull/5176
• feat: SSO MFA - SSO MFA challenge creation and verification #47684
• feat: SSO MFA - Add SSO MFA ceremony #46982 (tctl and tsh)
  • prereq: Refactor CLI prompt and config logic #47874
  • prereq: Unify and simplify MFA Ceremony helpers #46986
  • prereq: SSO Ceremony refactor #46983
  • prereq: Remove SolveAuthenticateChallenge from MFA Ceremony in favor of PromptConstructor #47650
• feat: SSO MFA - Teleport Connect #48036
  • prereq: Remove CLI-based config options from Teleport Connect MFA prompts #47875
  • prereq: Teleport Connect allow SSO hostname #48035
• feat: SSO MFA - WebUI backend implementation #47832 (per-session MFA)
  • Rename useWebAuthn to useMfa and handle SSO challenges #47819
  • Use challenge response when adding MFA device #47593
  • https://github.com/gravitational/teleport.e/pull/5229
  • Add SSO option during PerSessionMFA in the web #47876
• Full WebUI support
  • Moderated sessions
  • file transfers
  • admin actions
  • device management
• Documentation
• Test plan