Add PSU provider

This provider implements the IDP authentication mechanism necessary to
authenticate with Penn State University's custom implementation of Shibboleth,
Cosign, and Duo, based on the work originally done in
https://github.com/acobaugh/psu-aws-saml-login.

Gopkg.toml

@@ -84,3 +84,7 @@
 [prune]
   go-tests = true
   unused-packages = true
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/headzoo/surf"

cmd/saml2aws/main.go

@@ -46,12 +46,12 @@ func main() {
 
 	// Settings not related to commands
 	verbose := app.Flag("verbose", "Enable verbose logging").Bool()
-	provider := app.Flag("provider", "This flag it is obsolete see https://github.com/Versent/saml2aws#adding-idp-accounts.").Short('i').Enum("ADFS", "ADFS2", "Ping", "JumpCloud", "Okta", "OneLogin", "KeyCloak")
+	provider := app.Flag("provider", "This flag it is obsolete see https://github.com/Versent/saml2aws#adding-idp-accounts.").Short('i').Enum("ADFS", "ADFS2", "Ping", "JumpCloud", "Okta", "OneLogin", "PSU", "KeyCloak")
 
 	// Common (to all commands) settings
 	commonFlags := new(flags.CommonFlags)
 	app.Flag("idp-account", "The name of the configured IDP account").Short('a').Default("default").StringVar(&commonFlags.IdpAccount)
-	app.Flag("idp-provider", "The configured IDP provider").EnumVar(&commonFlags.IdpProvider, "ADFS", "ADFS2", "Ping", "JumpCloud", "Okta", "OneLogin", "KeyCloak")
+	app.Flag("idp-provider", "The configured IDP provider").EnumVar(&commonFlags.IdpProvider, "ADFS", "ADFS2", "Ping", "JumpCloud", "Okta", "OneLogin", "PSU", "KeyCloak")
 	app.Flag("mfa", "The name of the mfa").StringVar(&commonFlags.MFA)
 	app.Flag("skip-verify", "Skip verification of server certificate.").Short('s').BoolVar(&commonFlags.SkipVerify)
 	app.Flag("url", "The URL of the SAML IDP server used to login.").StringVar(&commonFlags.URL)

pkg/provider/psu/README.md

@@ -0,0 +1,21 @@
+# PSU provider
+
+This provider authenticates via Penn State University's Cosign+Shibboleth
+implementation, then handles the typical WebAccess 2FA multi-factor
+authentication using either Duo or YubiKeys.
+
+## Instructions
+
+Uses default Shibboleth 3.3 pathing for the entry point.  e.g. if url is
+"https://idp.example.com" and the AWS URN is left as the default, this will
+construct the following URL to use.
+`https://idp.example.com/idp/profile/SAML2/Unsolicited/SSO?providerId=urn:amazon:webservices`
+
+To configure for PSU Access Shibboleth, run `saml2aws configure`, select PSU as
+the provider, and enter `https://as1.fim.psu.edu` for URL. Username is
+optional.
+
+## Features
+
+* Prompts for Duo MFA when logging in. Options are Duo Push, Phone Call, and
+  Passcode. Similar to the Duo SSH integration.