protected Set<Event> resolveMultifactorAuthenticationProvider(final Optional<RequestContext> context,
                                                                  final RegisteredService registeredService,
                                                                  final Service service,
                                                                  final Principal principal) {
        val events = determineMultifactorAuthenticationEvent(context, registeredService, service, principal);
        val deny = casProperties.getAuthn().getMfa().getTriggers().getPrincipal().isDenyIfUnmatched();
        if (deny && (events == null || events.isEmpty())) {
            throw new AuthenticationException(new MultifactorAuthenticationRequiredException(registeredService, principal));
        }
        return events;
    }
This is {@link PrincipalAttributeMultifactorAuthenticationTrigger}.

@author Misagh Moayyed
@since 6.0.0
core/cas-server-core-authentication-mfa-api/src/main/java/org/apereo/cas/authentication/mfa/trigger/PrincipalAttributeMultifactorAuthenticationTrigger.java