Automatically check that there is no person or account that can admin both first and second factor services

[gdestuynder]

Examples:

• auth0 admin (highly privileged: calls 1fa, 2fa, forwards authorization data)
• cis admin (highly privileged / integrates all but password data)
• ldap admin (password data)
• mozillians admin (highly privileged / groups & authorization)
• duo admin (2fa only)
• 2nd opinion admin (calls 2fa + 1st, separated, 2nd opinion on authorization)

@claudijd proposes running this automatically on pen-test automation (see https://github.com/mozilla/pentest-automation/) @gene1wood is removing himself from auth0 admin when 2nd opinion goes live

Timeline: propose to add to as print during Q3

[gdestuynder]

Alternative: 2man rule for any action on these

[gdestuynder]

plan to do this in Q12018 after 2nd opinion and Q4O1_Slack