code: @Override
      protected AuthenticationHandlerExecutionResult doAuthentication(final Credential credential) throws GeneralSecurityException {
          if (credential instanceof DuoDirectCredential) {
              LOGGER.debug("Attempting to directly authenticate credential against Duo");
              return authenticateDuoApiCredential(credential);
          }
          return authenticateDuoCredential(credential);
      }
docs: Do an out of band request using the DuoWeb api (encapsulated in DuoSecurityAuthenticationService)
  to the hosted duo service. If it is successful
  it will return a String containing the username of the successfully authenticated user, but if not - will
  return a blank String or null.
  
  @param credential Credential to authenticate.
  @return the result of this handler
  @throws GeneralSecurityException general security exception for errors