How to terminate MFA flow with an error?

[Cantor, Scott]

> I have this logic coded in a MFA script, but I'm not sure what is the best way to
> handle the "error case" where the first factor (Password) alone is not sufficient,
> but the user is not registered with Duo.

I guess that depends what you want it to do, but if you're asking a more scoped question (i.e. what the subject line explicitly says), it's documented, https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration, CustomEvents

You can return any event you want, the rest is custom error handling. The only hassle is the bit about defining the event as a legal result of the authentication flow and that's the part it documents under that section.

> I have a rather ugly solution where the script sets the next flow to
> "authn/error" (undefined flow) and that definitely stops MFA dead in its tracks.
> However, the IDP itself does not display an error (which I could customize) and
> instead it responds to the SP with an error, so your browser shows a cryptic
> error from the SP.

There are people who believe that the IdP's job is to do what it's asked, and if it's asked for MFA and can't do so, the default behavior is to respond with a status saying so. That is what the standard more or less encourages so it's the default any time authentication fails and the IdP regains control.

-- Scott