I agree with these changes, which make the configuration more flexible than mine.
I would add this example for Shibboleth:
```yaml
      shibboleth:
        enabled: false
        label: 'Corporate SSO'
        allow_single_sign_on: true
        block_auto_created_users: false
        shib_session_id_field:     'HTTP_SHIB_SESSION_ID'
        shib_application_id_field: 'HTTP_SHIB_APPLICATION_ID'
        uid_field:   'HTTP_SSOUNIXNAME'
        name_field:  'HTTP_SSONAME'
        info_fields:
          email:    'HTTP_SSOCONTACTMAIL'
          nickname: 'HTTP_SSOUNIXNAME'
        debug: false 
```