<div dir="ltr"><div dir="ltr">Steven - <div><br></div><div> I know that those examples worked when the Passwordless support was released, but it's difficult to debug with the partial configuration.</div><div><br></div><div>The error you are reporting is occurring after the MFA flow has completed, do you have any (debug) logging that offers up status as the MFA is working? </div><div><br></div><div>Of note, if the request is including a specific authentication type, it could be that everything is working as you expect, but the end result does not satisfy that requirement..... </div><div><br></div><div>Steve.</div><div><br></div><div><br></div><div> </div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Mar 11, 2026 at 3:20 PM Mak, Steven via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Hello all,</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
In the DuoOIDCPasswordless configuration page there is an example movie where the user is returned to a password prompt screen if the factors are deemed unacceptable. I've read over the "Event Handling" section of the document several times. I've configured
my mfa-authn-config.xml file to watch for these events in the authn/DuoOIDC nextFlowStrategy Map, but my IdP only seems to stop trying once it hits a RequestUnsupported result, instead of proceeding to the script ref I provide.</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Does anyone have an example of how these event handlers are supposed to be wired up?</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
A non-proceed event occurred while processing the request: RequestUnsupported</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Am I missing some documentation on how to transition to from this event to my script? My checkFirstFactor clears the duoContext and sends the user to authn/Password just like the documented example, but it doesn't work.</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Here's the nextFlowStrategyMap I have:</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="authn/DuoOIDC"></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<bean parent="shibboleth.authn.MFA.Transition"></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<property name="nextFlowStrategyMap"></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<map></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="RequestUnsupported" value-ref="checkFirstFactor"/></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="ReselectFlow" value-ref="checkFirstFactor"/></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="IdentitySwitch" value-ref="checkFirstFactor"/></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="InvalidCredentials" value-ref="checkFirstFactor"/></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
</map></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
</property></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
</bean></div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
</entry></div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless</a></div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div>