SimpleSAMLphp is quite straightforward; use the Yubikey auth source and you get their 2FA very easily. SAML2 will never be quite as easy to configure as OpenID

SimpleSAMLphp is quite straightforward; use the Yubikey auth source and you get their 2FA very easily. SAML2 will never be quite as easy to configure as OpenID in practice, but it's the least painful setup I've seen. (Yes, I include several of the big commercial authentication-as-a-service vendors in that comparison.) Having the ability to easily manipulate attributes at a per-SP level makes integrating with semi-broken vendor implementations much more practical. There are modules available to add OpenID and OAuth; I use the OpenID module in production and have been quite happy with it.