@Override
    public AuthenticationPolicyExecutionResult isSatisfiedBy(final Authentication authn,
                                                             final Set<AuthenticationHandler> authenticationHandlers,
                                                             final ConfigurableApplicationContext applicationContext,
                                                             final Map<String, ? extends Serializable> context) {
        var credsOk = true;
        val sum = authn.getSuccesses().size() + authn.getFailures().size();
        if (this.tryAll) {
            credsOk = authn.getCredentials().size() == sum;
        }

        if (!credsOk) {
            LOGGER.warn("Number of provided credentials [{}] does not match the sum of authentication successes and failures [{}]. "
                        + "Successful authentication handlers are [{}]", authn.getCredentials().size(), sum, authn.getSuccesses().keySet());
            return AuthenticationPolicyExecutionResult.failure();
        }

        return isSatisfiedByInternal(authn);
    }
Flag to try all credentials before policy is satisfied.
core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/BaseAuthenticationHandlerAuthenticationPolicy.java