<commit_before>---
layout: default
title: CAS - Multifactor Authentication Triggers
---

# Multifactor Authentication Triggers

The following triggers can be used to activate and instruct CAS to navigate to a multifactor authentication flow.
To see the relevant list of CAS properties, please [review this guide](Configuration-Properties.html#multifactor-authentication).

The execution order of multifactor authentication triggers is outlined below:

1. Adaptive
2. Global
3. Opt-In Request Parameter
4. REST Endpoint
5. Groovy Script
6. Principal Attribute Per Application
7. Global Principal Attribute Predicate
8. Global Principal Attribute
9. Global Authentication Attribute
10. Applications
11. Grouper
12. Other

Each trigger should properly try to ignore the authentication request, if applicable confguration is not found for its activation and execution.

Also note that various CAS modules present and inject their own *internal triggers* into the CAS application runtime in order to translate protocol-specific authentication requests into multifactor authentication flows.

## Global

MFA can be triggered for all applications and users regardless of individual settings.

To see the relevant list of CAS properties, please [review this guide](Configuration-Properties.html#multifactor-authentication).

## Applications<commit_msg>Doc updates<commit_after>---
layout: default
title: CAS - Multifactor Authentication Triggers
---

# Multifactor Authentication Triggers

The following triggers can be used to activate and instruct CAS to navigate to a multifactor authentication flow.
To see the relevant list of CAS properties, please [review this guide](Configuration-Properties.html#multifactor-authentication).

The execution order of multifactor authentication triggers is outlined below:

1. Adaptive
2. Global
3. Opt-In Request Parameter
4. REST Endpoint
5. Groovy Script
6. Principal Attribute Per Application
7. Global Principal Attribute Predicate
8. Global Principal Attribute
9. Global Authentication Attribute
10. Applications
11. Grouper
12. Other

Each trigger should properly try to ignore the authentication request, if applicable confguration is not found for its activation and execution. Also note that various CAS modules present and inject their own *internal triggers* into the CAS application runtime in order to translate protocol-specific authentication requests into multifactor authentication flows.

<div class="alert alert-info"><strong>Service Requirement</strong><p>Most multifactor authentication triggers require that the original authentication request submitted to CAS contain a <code>service</code> parameter. Failure to do so will simply result in an initial successful authentication attempt where subsequent requests that carry the relevant parameter will elevate the authentication context and trigger multifactor later. If you need to test a particular trigger, remember to provide the <code>service</code> parameter appropriately to see the trigger in action.</div>

## Global

MFA can be triggered for all applications and users regardless of individual settings.

To see the relevant list of CAS properties, please [review this guide](Configuration-Properties.html#multifactor-authentication).

## Applications
{'fraction_non_alphanumeric': 0.0453153704837722, 'fraction_numerical': 0.009185548071034905, 'mean_word_length': 5.443786982248521, 'pattern_counts': {'":': 0, '<': 12, '<?xml version=': 0, '>': 12, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7155507', 'n_tokens_mistral': 749, 'n_tokens_neox': 698, 'n_words': 403}