> why wouldn't the admin need to configure a WAYF service? Is there one global one or something?

WAYF/Discovery services/.. are all session initiators that should be made available at a URL (e.g.: `/Shibboleth.sso/Login`). The `idpEntityID` config value is there if you know with which Identity Provider you want all users of your tenant to authenticate.

> Also, IIUC a WAYF service is just a landing page that will allow a user to select their IdP

That's correct. See https://test.ukfederation.org.uk/Shibboleth.sso/UKfedDS for an example of a Discovery Service

> Under what circumstances will a tenant want to use this, over just sending the user directly to their IdP?

The French are eager to use this kind of discovery. I don't think we will be enabling it in our environments, but we should probably support the possibility of having it.

> If a tenant uses a WAYF to start, then decides later it wants to just send users directly to their IdP, does anything change in the externalId / remote_user? We wouldn't want a configuration change like that to result in auto-creation of duplicate users

The value of `remote_user` is configured in the Shibboleth SP configuration. Shibboleth allows you to configure this per hostname (=OAE tenant) and is usually based on the attributes that the IdP releases.

If you switch from WAYF/DS to direct-IdP authentication and all your users were using the same IdP that you just configured, there shouldn't be a problem (I *think*) as it's still the same IdP that provided the attributes. However, if you had users that were authenticating with another IdP, then they will either not be able to log in anymore, or, if they have an account with the direct-IdP as well, they will be able to log in but with a different `remote_user` value and thus a different value.

I agree that WAYF/DS opens up potential problems in the future and is something that should be considered carefully.