Trigger or Bypass MFA

[livio dezorzi]

In a Zero Trust architecture, the internal network is no longer considered an area of ​​absolute trust, especially if privileges are high there for some users.
I'd also like to find the best approach to apply Simple MFA to internal users. The public application is already configured if the user is in the appropriate "Argos" group (@class DefaultRegisteredServiceAccessStrategy), so is it possible to configure the DefaultRegisteredServiceMultifactorPolicy class to apply MFA if the user is also part of a new "Argos-MFA" group ?
 

[Ray Bon]

Livio,

Many MFA triggers allow a regex for the value.

If that does not work, you can use a groovy script [1].

Ray

[1] https://apereo.github.io/cas/7.2.x/mfa/Configuring-Multifactor-Authentication-Triggers-Groovy.html

---

From: cas-...@apereo.org <cas-...@apereo.org> on behalf of livio dezorzi <livio....@gmail.com>
Sent: April 27, 2026 04:35
To: CAS Community <cas-...@apereo.org>
Subject: [cas-user] Trigger or Bypass MFA

 

In a Zero Trust architecture, the internal network is no longer considered an area of ​​absolute trust, especially if privileges are high there for some users.
I'd also like to find the best approach to apply Simple MFA to internal users. The public application is already configured if the user is in the appropriate "Argos" group (@class DefaultRegisteredServiceAccessStrategy), so is it possible to configure the DefaultRegisteredServiceMultifactorPolicy class to apply MFA if the user is also part of a new "Argos-MFA" group ?
 

--
- Website: https://apereo.github.io/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/00a4783c-2e91-4f0c-bf69-b4116992d87an%40apereo.org.

[Livio De Zorzi]

Hi Ray,

I used MFA triggers but i had an issue and I found my mistake. It was necessary to use the source attribute ldap instead of the friendly attribute.

Regards 

Le 27 avr. 2026 à 19:25, 'Ray Bon' via CAS Community <cas-...@apereo.org> a écrit :



To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/YQBP288MB00817A24CFEA73383F82CD3ECE362%40YQBP288MB0081.CANP288.PROD.OUTLOOK.COM.

[livio dezorzi]

Hi,

Always on MFA, is it possible to modify the message. I use only adress mail to send the token and we want to simplify it ?

I searched in all the sources some words of the message without result.

Can we use a text in custom_messages.properties or other configuration ?

Regards

[Ray Bon]

Livio,

You can find that message in

https://github.com/apereo/cas/blob/master/support/cas-server-support-thymeleaf/src/main/resources/messages_fr.properties

We put all our overrides in a custom_messages.properties file that is in our src/main/resources folder.

Ray

---

From: cas-...@apereo.org <cas-...@apereo.org> on behalf of livio dezorzi <livio....@gmail.com>

Sent: April 29, 2026 23:31
To: CAS Community <cas-...@apereo.org>
Cc: Livio De Zorzi <livio....@gmail.com>; cas-...@apereo.org <cas-...@apereo.org>
Subject: Re: [cas-user] Trigger or Bypass MFA

 

To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/a6055d39-666f-4376-898b-5fb1223258f8n%40apereo.org.