<html><body><font face="ui-sans-serif, sans-serif" style="font-size:13px">Attempting to intercept and abort logins for a couple of conditions flagged by attribute values (catching them even if a valid SSO session exists). I seem to have the logic flowing correctly in conf/authn/mfa-authn-config.xml to detect either error condition prior to checking for Duo MFA. The further handling of two events in conf/authn/authn-events-flow.xml stumped me though. After botched attempts, this seems to work, but I’d appreciate sanity checking this:</font><div dir="ltr"><font face="Menlo"><span style="font-size:11px">...<br></span></font><div><div><span style="font-size:12px"> <end-state id="stopLockedAccount" /></span></div><div><span style="font-size:12px"><br></span></div><div><span style="font-size:12px"> <end-state id="stopExpiredAccount" /></span></div><div><span style="font-size:12px"><br></span></div><div><span style="font-size:12px"> <global-transitions></span></div><div><span style="font-size:12px"> <transition on="stopLockedAccount" to="stopLockedAccount" /></span></div><div><span style="font-size:12px"> <transition on="stopExpiredAccount" to="stopExpiredAccount" /></span></div><div><span style="font-size:12px"> <transition on="#{!'proceed'.equals(currentEvent.id)}" to="InvalidEvent" /></span></div><div><span style="font-size:12px"> </global-transitions></span></div></div><div dir="ltr">…</div><div dir="ltr"><br></div><div dir="ltr">David St. Pierre Bantz</div><div dir="ltr">U Alaska</div></div></body></html>