No longer relevant.

I started to package endroid-qrcode for Debian and saw that there is a new upstream release 1.6.5 available. The changelog has:

Better fix submitted in D242. Waiting for approval

A test with TOTP was successful.

Hm, there seems to be some confusion between method (driver to use) and id (yubikey:<hexcode>). the plugin tried to load config['kolab_2fa_yubikey:<hexcode>'] which obvously fails. The following patch (against Winterfell) seems to fix it for me - but I didn't test HOTP or TOTP token. And already added yubikeys had to be removed and readded.

The configuration options should already make their way into the $config member of the Yubikey class. They are read in kolab_2fa::get_driver(), passed through Kolab2FA\Driver\Base::factory() all the way to Kolab2FA\Driver\Base::init() where they are merged with $this->config. It's to be investigated why the following line in Base.php doesn't work as expected:

$this->config = array_merge($this->config, $config);