@Override
    protected Event doExecuteInternal(final RequestContext requestContext) throws Throwable {
        val authentication = WebUtils.getAuthentication(requestContext);
        if (authentication == null) {
            LOGGER.warn("Could not determine authentication from the request context");
            return no();
        }
        val registeredService = WebUtils.getRegisteredService(requestContext);
        val service = WebUtils.getService(requestContext);

        val trustedDevicesDisabled = MultifactorAuthenticationTrustUtils.isMultifactorAuthenticationTrustedDevicesDisabled(requestContext);
        val publicWorkstation = WebUtils.isAuthenticatingAtPublicWorkstation(requestContext);
        if (publicWorkstation || trustedDevicesDisabled || bypassEvaluator.shouldBypassTrustedDevice(registeredService, service, authentication)) {
            LOGGER.debug("Trusted device registration is disabled for [{}]", registeredService);
            return result(CasWebflowConstants.TRANSITION_ID_SKIP);
        }
        val principal = authentication.getPrincipal().getId();
        LOGGER.trace("Retrieving trusted authentication records for [{}]", principal);
        val results = storage.isAvailable() ? storage.get(principal) : Set.<MultifactorAuthenticationTrustRecord>of();
        if (results.isEmpty()) {
            LOGGER.debug("No valid trusted authentication records could be found for [{}]", principal);
            return no();
        }
        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);
        val response = WebUtils.getHttpServletResponseFromExternalWebflowContext(requestContext);
        val fingerprint = deviceFingerprintStrategy.determineFingerprint(authentication, request, response);
        LOGGER.trace("Retrieving authentication records for [{}] that matches [{}]", principal, fingerprint);
        val foundRecord = results.stream()
            .filter(entry -> StringUtils.isNotBlank(entry.getDeviceFingerprint()))
            .filter(entry -> entry.getDeviceFingerprint().equals(fingerprint))
            .findAny();
        if (foundRecord.isEmpty()) {
            LOGGER.debug("No trusted authentication records could be found for [{}] to match the current device fingerprint", principal);
            return no();
        }
        LOGGER.debug("Trusted authentication records found for [{}] that matches the current device fingerprint", principal);
        MultifactorAuthenticationTrustUtils.setMultifactorAuthenticationTrustedInScope(requestContext);
        MultifactorAuthenticationTrustUtils.trackTrustedMultifactorAuthenticationAttribute(
            authentication, trustedProperties.getCore().getAuthenticationContextAttribute());
        MultifactorAuthenticationTrustUtils.putMultifactorAuthenticationTrustRecord(requestContext, foundRecord.get());
        return yes();
    }
This is {@link MultifactorAuthenticationVerifyTrustAction}.

@author Misagh Moayyed
@since 5.0.0
support/cas-server-support-trusted-mfa-core/src/main/java/org/apereo/cas/trusted/web/flow/MultifactorAuthenticationVerifyTrustAction.java