I'm not really familiar with these shib concepts, but why wouldn't the admin need to configure a WAYF service? Is there one global one or something?

Also, IIUC a WAYF service is just a landing page that will allow a user to select their IdP. A couple questions about that:

* Under what circumstances will a tenant want to use this, over just sending the user directly to their IdP?
* If a tenant uses a WAYF to start, then decides later it wants to just send users directly to their IdP, does anything change in the `externalId` / `remote_user`? We wouldn't want a configuration change like that to result in auto-creation of duplicate users