How to terminate MFA flow with an error?

[O'Dowd, Josh]

>I spotted it, the way it's meant to be done is you signal "null" but set the Event property in the MultiFactorAuthenticationContext object in the tree and it will use that Event as the outcome.

> -- Scott

Yes.  BWO example, we use the following transition for Duo cancellations and then script adding a friendly/targeted error event that lands the user on an "error page" with appropriate messaging:

In conf/authn/mfa-confilg.xml:
	<entry key="authn/Duo">
		<bean parent="shibboleth.authn.MFA.Transition">
			<property name="nextFlowStrategyMap">
				<map>
					<entry key="ReselectFlow" value-ref="duo-cancelled"/>
				</map>
			</property>
		</bean>
	</entry>

... the value-ref fires the "duo-cancelled" script:
    	<bean id="duo-cancelled" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript">
		<constructor-arg>
			<value>
		    	<![CDATA[
				... scripting for setting the Event property in MFAC
				null;
		    	]]>
		    	</value>
		</constructor-arg>
    	</bean>

...  MFA sends the event out to IdP's native error handler mechanisms.

-Josh