DuoOIDC passwordless event handling question

[Mak, Steven]

Hello all,

In the DuoOIDCPasswordless configuration page there is an example movie where the user is returned to a password prompt screen if the factors are deemed unacceptable. I've read over the "Event Handling" section of the document several times. I've configured my mfa-authn-config.xml file to watch for these events in the authn/DuoOIDC nextFlowStrategy Map, but my IdP only seems to stop trying once it hits a RequestUnsupported result, instead of proceeding to the script ref I provide.

Does anyone have an example of how these event handlers are supposed to be wired up?

Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request
A non-proceed event occurred while processing the request: RequestUnsupported

Am I missing some documentation on how to transition to from this event to my script? My checkFirstFactor clears the duoContext and sends the user to authn/Password just like the documented example, but it doesn't work.

Here's the nextFlowStrategyMap I have:

        <entry key="authn/DuoOIDC">
            <bean parent="shibboleth.authn.MFA.Transition">
                <property name="nextFlowStrategyMap">
                    <map>
                        <entry key="RequestUnsupported" value-ref="checkFirstFactor"/>
                        <entry key="ReselectFlow" value-ref="checkFirstFactor"/>
                        <entry key="IdentitySwitch" value-ref="checkFirstFactor"/>
                        <entry key="InvalidCredentials" value-ref="checkFirstFactor"/>
                    </map>
                </property>
            </bean>
        </entry>


https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260311/ea35d8f0/attachment.htm>