How to raise an exception after successful delegated authentication in CAS?

Question

We are running CAS Server 5.2.2 with 2 authentication handlers. One of them is a custom authentication handler where we are able to manage any kind of scenario. The other one is setup to delegate authentication to another identity provider which validates several types of credentials (digital certificates, ...).

Our problem is with the delegated authentication: the integration via oauth2 works fine and we release Principal attributes using a groovy script. Our new case is the following:

• After a successful delegated authentication we need to evaluate some attributes and depending on their values mark the final authentication as failed.

How can we achieve this? We have tried to throw an Exception (registered in application.properties) in the groovy script that releases the Principal attributes but it does not seem to work.