@Override
    public Optional<MultifactorAuthenticationProvider> isActivated(final Authentication authentication,
                                                                   final RegisteredService registeredService,
                                                                   final HttpServletRequest httpServletRequest,
                                                                   final HttpServletResponse response,
                                                                   final Service service) throws Throwable {
        if (authentication == null || registeredService == null) {
            LOGGER.debug("No authentication or service is available to determine event for principal");
            return Optional.empty();
        }

        val policy = registeredService.getMultifactorAuthenticationPolicy();
        if (policy == null || StringUtils.isBlank(policy.getScript())) {
            LOGGER.trace("Multifactor authentication policy is absent or does not define a script to trigger multifactor authentication");
            return Optional.empty();
        }

        val mfaScript = policy.getScript();
        val providerMap = MultifactorAuthenticationUtils.getAvailableMultifactorAuthenticationProviders(this.applicationContext);
        if (providerMap.isEmpty()) {
            LOGGER.error("No multifactor authentication providers are available in the application context");
            throw new AuthenticationException(new MultifactorAuthenticationProviderAbsentException());
        }

        LOGGER.trace("Locating multifactor authentication trigger script [{}]...", mfaScript);
        val executableScript = fetchScript(mfaScript);
        if (executableScript != null) {
            LOGGER.debug("Executing multifactor authentication trigger script [{}]", executableScript);
            val result = executableScript.execute(new Object[]{authentication, registeredService, httpServletRequest,
                service, applicationContext, LOGGER}, String.class);
            LOGGER.debug("Multifactor authentication provider delivered by trigger script is [{}]", result);
            if (StringUtils.isBlank(result)) {
                LOGGER.debug("No multifactor authentication is returned from trigger script");
                return Optional.empty();
            }
            val providerResult = providerMap.values().stream().filter(provider -> provider.getId().equalsIgnoreCase(result)).findFirst();
            if (providerResult.isEmpty()) {
                LOGGER.error("Unable to locate multifactor authentication provider [{}] in the application context", result);
                throw new AuthenticationException(new MultifactorAuthenticationProviderAbsentException());
            }
            return providerResult;
        }
        return Optional.empty();
    }
This is {@link ScriptedRegisteredServiceMultifactorAuthenticationTrigger}.

@author Misagh Moayyed
@since 6.2.0
core/cas-server-core-authentication-mfa-api/src/main/java/org/apereo/cas/authentication/mfa/trigger/ScriptedRegisteredServiceMultifactorAuthenticationTrigger.java