@Override
    protected Event doExecuteInternal(final RequestContext requestContext) throws Throwable {
        val authentication = WebUtils.getAuthentication(requestContext);
        val principal = resolvePrincipal(authentication.getPrincipal(), requestContext);
        val account = getDuoSecurityUserAccount(principal);
        val eventFactorySupport = eventFactory;
        if (account.getStatus() == DuoSecurityUserAccountStatus.ENROLL
            && StringUtils.isNotBlank(provider.getRegistration().getRegistrationUrl())) {
            val url = buildDuoRegistrationUrlFor(requestContext, provider, principal);
            LOGGER.info("Duo Security registration url for enrollment is [{}]", url);
            requestContext.getFlowScope().put("duoRegistrationUrl", url);
            return eventFactorySupport.event(this, CasWebflowConstants.TRANSITION_ID_ENROLL);
        }
        if (account.getStatus() == DuoSecurityUserAccountStatus.ALLOW) {
            return eventFactorySupport.event(this, CasWebflowConstants.TRANSITION_ID_BYPASS);
        }
        if (account.getStatus() == DuoSecurityUserAccountStatus.DENY) {
            return eventFactorySupport.event(this, CasWebflowConstants.TRANSITION_ID_DENY);
        }
        if (account.getStatus() == DuoSecurityUserAccountStatus.UNAVAILABLE) {
            return eventFactorySupport.event(this, CasWebflowConstants.TRANSITION_ID_UNAVAILABLE);
        }

        return success();
    }
This is {@link DuoSecurityDetermineUserAccountAction}.

@author Misagh Moayyed
@since 5.2.0
support/cas-server-support-duo-core/src/main/java/org/apereo/cas/adaptors/duo/web/flow/action/DuoSecurityDetermineUserAccountAction.java