@Override
    protected AuthenticationRiskContingencyResponse executeInternal(final Authentication authentication,
                                                                    final RegisteredService service,
                                                                    final AuthenticationRiskScore score,
                                                                    final HttpServletRequest request) {
        var id = casProperties.getAuthn().getAdaptive().getRisk().getResponse().getMfaProvider();
        if (StringUtils.isBlank(id)) {
            LOGGER.debug("No explicit multifactor authentication provider is defined to handle risk-based authentication.");
            val providerMap = MultifactorAuthenticationUtils.getAvailableMultifactorAuthenticationProviders(this.applicationContext);
            if (providerMap.isEmpty()) {
                LOGGER.warn("No multifactor authentication providers are available in the application context. Authentication is blocked");
                throw new AuthenticationException(new RiskyAuthenticationException());
            }

            if (providerMap.size() == 1) {
                id = providerMap.values().iterator().next().getId();
            } else {
                LOGGER.warn("No multifactor authentication providers are specified to handle risk-based authentication");
                throw new AuthenticationException(new MultifactorAuthenticationProviderAbsentException());
            }
        }

        LOGGER.debug("Attempting to handle risk-based authentication via multifactor authentication provider [{}]", id);
        val attributeName = casProperties.getAuthn().getAdaptive().getRisk().getResponse().getRiskyAuthenticationAttribute();
        val newAuthn = DefaultAuthenticationBuilder.newInstance(authentication)
            .addAttribute(attributeName, Boolean.TRUE)
            .build();
        LOGGER.debug("Updated authentication to remember risk-based authentication via [{}]", attributeName);
        authentication.updateAttributes(newAuthn);
        return new AuthenticationRiskContingencyResponse(new Event(this, id));
    }
This is {@link MultifactorAuthenticationContingencyPlan}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-electrofence/src/main/java/org/apereo/cas/impl/plans/MultifactorAuthenticationContingencyPlan.java