Multi-Factor Authentication in Spring Security 7

Spring Security 7 introduces native multi-factor authentication (MFA) support using a factor-based authority model. Each successful authentication step grants a FactorGrantedAuthority to the user's security context. The new @EnableMultiFactorAuthentication annotation enables MFA globally, while AuthorizationManagerFactory allows applying MFA rules to specific endpoints. The post covers global MFA setup, endpoint-specific rules, time-based re-authentication requirements, user-based conditional MFA, and unit testing MFA flows with Spring Security test utilities.