How to terminate MFA flow with an error?

[Cantor, Scott]

> Carefully rereading the wiki, I conclude that the MFA transition map (and my
> associated script) can ONLY return authn flow names (or null).  In particular,
> the transition map cannot cause the MFA flow to terminate with a specified
> event.

No, that's not the case (or isn't meant to be). It can signal any event. It detects events that start with "authn/" to treat them in a different way (yes, it's hacky) but the overall mechanism can handle anything.

> Efficiency concern: does the IDP run the attribute resolver multiple times or
> does it cache?  The IDP will reference attributes in at least three places: MFA
> transition, context check intercept, attribute filter.

Caching has to be configured by you. If it's not told to cache, it won't.

-- Scott