Duo MFA with Exernal AuthN as first flow

[Cantor, Scott]

> If the first flow fails, your scripting/workflow should be preventing the Duo
> flow from running, so that shouldn't be the reason for the exception and it
> certainly isn't how it works by default.

Overnight epiphany...if the flow you're using is *based* on the External flow, but is a copy of it, not just a servlet that's receiving and handling the external authentication request, it probably is a copy of the pre-3.3 flow that leaves out a step to get the user identity in place.

Older login flows are still compatible with 3.3, but the Duo flow's assumptions are only met by the modified versions of the flows that ship with 3.3. Specifically, I moved subject canonicalization into each login flow instead of relying on the master authn flow to handle it.

So yes, you're probably correct that there's a compatibility issue there.

- Scott