Fabrice, > Or based on an LDAP attribute, could I apply eventually a second step in authentication workflow, eg. an MFA attribute telling if the user group need multiple factor authentication ? May I implement this using custom scripts ? Without getting into too many specifics on how to build an interception script, please take a look at the Duo example that comes as a default. It's a great example of how to use all the functions in the scripts. https://github.com/GluuFederation/community-edition-setup/blob/master/static/extension/person_authentication/DuoExternalAuthenticator.py Specifically this line for your use case example: https://github.com/GluuFederation/community-edition-setup/blob/master/static/extension/person_authentication/DuoExternalAuthenticator.py#L111 This is where they check if a user has the `duo_group` attribute https://github.com/GluuFederation/community-edition-setup/blob/master/static/extension/person_authentication/DuoExternalAuthenticator.py#L41