We need a cookbook which removes a registered U2F token from the device database (so that it can get easily revoked if a device is stolen/lost/broken).
And once there's a cookbook we could also fold calling the current modify-mfa script into it (so simplify management for whoever's on SRE clinic duty). Maybe something like the following?
sre.idm.u2f [--enable|--disable|--reset-token] $USER
Change 739276 had a related patch set uploaded (by Jbond; author: jbond):
[operations/cookbooks@master] cookbook sre.idm.u2f: add cookbook to enable/disable u2f
Change 739279 had a related patch set uploaded (by Jbond; author: jbond):
[operations/puppet@production] apereo_cas: add cas_u2f script
Change 739279 merged by Jbond:
[operations/puppet@production] apereo_cas: add cas_u2f script
Change 739276 merged by jenkins-bot:
[operations/cookbooks@master] cookbook sre.idm.u2f: add cookbook to enable/disable u2f