CHANGELOG.md

+## [10.7.6](https://gitlab.ics.muni.cz/perun-proxy-aai/simplesamlphp/simplesamlphp-module-authswitcher/compare/v10.7.5...v10.7.6) (2022-10-25)
+
+
+### Bug Fixes
+
+* correct rollout_state handling ([6dcbb86](https://gitlab.ics.muni.cz/perun-proxy-aai/simplesamlphp/simplesamlphp-module-authswitcher/commit/6dcbb86dff0aa3b889b676a672838e1b3ee48b50))
+
 ## [10.7.5](https://gitlab.ics.muni.cz/perun-proxy-aai/simplesamlphp/simplesamlphp-module-authswitcher/compare/v10.7.4...v10.7.5) (2022-10-21)
 
 

lib/Auth/Process/GetMfaTokensPrivacyIDEA.php

@@ -167,7 +167,10 @@ class GetMfaTokensPrivacyIDEA extends \SimpleSAML\Auth\ProcessingFilter
         $types = [];
         foreach ($tokens as $token) {
             foreach ($this->tokens_type as $type) {
-                if ($token['tokentype'] === strtolower($type) && empty($token['rollout_state'])) {
+                if (
+                    $token['tokentype'] === strtolower($type)
+                    && !in_array($token['rollout_state'] ?? '', ['clientwait', 'verify'])
+                ) {
                     $token[$this->token_type_attr] = $type;
                     $types[] = $token;
                     break;