NoPotentialFlow issue with a specific SP with IdP 3.2.1

[Tom Zeller]

On Mon, Jul 4, 2016 at 11:07 AM, Mark Cairney <Mark.Cairney at ed.ac.uk> wrote:
> Hi,
>
> I'm in the process of going through which SPs work and which ones don't
> with Shib 3 before we can go live. One of our SPs seems to be dropping
> the RemoteUser flow but I can't see why. Checking the Apache and tomcat
> logs it is receiving the REMOTE_USER variable and it's being picked up
> by tomcat.
>
> This SP works fine with Shib 2 and has no special configuration other
> than some additional attributes being released.
>
> This is the error below- I've attached the complete debug log of the
> transaction
>
> 2016-07-04 15:09:07,450 - DEBUG
> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:269] - Profile
> Action SelectAuthenticationFlow: Forced authentication requested,
> selecting an inactive flow
> 2016-07-04 15:09:07,452 - ERROR
> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:273] - Profile
> Action SelectAuthenticationFlow: No potential flows left to choose from,
> authentication will fail
> 2016-07-04 15:09:07,457 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
> while processing the request: NoPotentialFlow
>
> Any ideas? Does the issue lie with the SP or with the IdP?

Not sure, but the following is where I would start :

2016-07-04 15:09:07,444 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:75] - Profile
Action FilterFlowsByForcedAuthn: Removing flow authn/RemoteUser, it
does not support forced authentication

It also looks like you are using the default relying party
configuration for this entity, so you will probably need an override,
which Scott has well documented on the wiki.