@Override
    public void registerMultifactorProviderAuthenticationWebflow(final Flow flow,
                                                                 final String subflowId,
                                                                 final String providerId) {
        if (flow == null) {
            LOGGER.error("Unable to locate parent flow definition to register provider [{}]", providerId);
            return;
        }

        multifactorAuthenticationFlowDefinitionRegistries
            .stream()
            .filter(registry -> registry.containsFlowDefinition(providerId))
            .forEach(registry -> {
                val mfaFlow = (Flow) registry.getFlowDefinition(providerId);
                mfaFlow.getStartActionList().add(new ConsumerExecutionAction(WebUtils::createCredential));
                val setCredential = createSetAction("flowScope.".concat(CasWebflowConstants.VAR_ID_MFA_PROVIDER_ID), StringUtils.quote(providerId));
                mfaFlow.getStartActionList().add(setCredential);

                val initStartState = (TransitionableState) mfaFlow.getStartState();
                val transition = (Transition) initStartState.getTransition(CasWebflowConstants.TRANSITION_ID_SUCCESS);
                val targetStateId = transition.getTargetStateId();
                transition.setTargetStateResolver(new DefaultTargetStateResolver(CasWebflowConstants.STATE_ID_MFA_CHECK_BYPASS));

                registerMultifactorProviderBypassAction(mfaFlow);
                registerMultifactorProviderAvailableAction(mfaFlow, targetStateId);
                registerMultifactorProviderFailureAction(flow, mfaFlow);
                registerMultifactorFlowExceptionHandlers(mfaFlow);

                val subflowState = createSubflowState(flow, providerId, providerId);
                val subflowMappings = getDefaultAttributeMappings()
                    .map(attr -> SCOPES
                        .stream()
                        .map(scope -> createFlowMapping(scope + '.' + attr, attr))
                        .collect(Collectors.toList()))
                    .flatMap(List::stream)
                    .collect(Collectors.toList());

                subflowMappings.add(createFlowMapping("flowScope." + CasWebflowConstants.VAR_ID_CREDENTIAL,
                    "parent" + StringUtils.capitalize(CasWebflowConstants.VAR_ID_CREDENTIAL)));

                multifactorAuthenticationFlowCustomizers.forEach(customizer -> customizer.getWebflowAttributeMappings()
                    .forEach(key -> SCOPES.forEach(scope -> subflowMappings.add(createFlowMapping(scope + '.' + key, key)))));
                val inputMapper = createFlowInputMapper(subflowMappings);
                val subflowMapper = createSubflowAttributeMapper(inputMapper, null);
                subflowState.setAttributeMapper(subflowMapper);

                val flowMappings = getDefaultAttributeMappings()
                    .map(attr -> createFlowMapping(attr, "flowScope." + attr))
                    .collect(Collectors.toList());
                flowMappings.add(createFlowMapping("parent" + StringUtils.capitalize(CasWebflowConstants.VAR_ID_CREDENTIAL),
                    "flowScope.parent" + StringUtils.capitalize(CasWebflowConstants.VAR_ID_CREDENTIAL)));

                multifactorAuthenticationFlowCustomizers.forEach(customizer -> customizer.getWebflowAttributeMappings()
                    .forEach(key -> SCOPES.forEach(scope -> flowMappings.add(createFlowMapping(key, scope + '.' + key)))));
                createFlowInputMapper(flowMappings, mfaFlow);

                val states = getCandidateStatesForMultifactorAuthentication();
                registerMultifactorAuthenticationSubflowWithStates(flow, subflowState, states);

                registerMultifactorFlowDefinitionIntoLoginFlowRegistry();
                augmentMultifactorProviderFlowRegistry();

                LOGGER.trace("Registering the [{}] flow into the flow [{}]", providerId, flow.getId());
                val startState = flow.getTransitionableState(flow.getStartState().getId());
                createTransitionForState(startState, providerId, providerId, true);

                val initState = getState(flow, CasWebflowConstants.STATE_ID_INITIAL_AUTHN_REQUEST_VALIDATION_CHECK);
                createTransitionForState(initState, providerId, providerId, true);
            });
    }
The flow definition registry for the mfa flow.
core/cas-server-core-webflow-mfa-api/src/main/java/org/apereo/cas/web/flow/configurer/AbstractCasMultifactorWebflowConfigurer.java