idp v3.1.2 webflow IllegalArgumentException in conditions-flow.xml

[Joe Edwards]

Here is another case of the webflow IllegalArgumentException.

Am I misusing the expression language?

I configured shibboleth v3.1.2 for duo.

The documented procedure has duo hard coded to run on every login.
   <!-- Enable Duo Two-Factor Authentication -->
   <evaluate expression="ValidateUsernamePassword" />
   <evaluate expression="'duo'" />
   <transition on="duo" to="DuoAuth" />
   <!-- End Duo Two-Factor Authentication -->
I do not get errors when the jaas login fails.
Users are returned to the login page to try again.

I revised conditions-flow.xml to provide duo 2 factor as an option.
   <!-- Enable Duo Two-Factor Authentication -->
   <evaluate expression="ValidateUsernamePassword" />
   <evaluate expression="requestParameters.duoStatus" />
   <transition on="duo" to="DuoAuth" />
   <transition on="" to="proceed" />
   <!-- End Duo Two-Factor Authentication
That works if the jaas login succeeds.
It fails if the jaas login fails and I see the following message:

  2016-09-01 09:06:50,370 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught
  runtime exception java.lang.IllegalArgumentException: Cannot find state
  with id 'InvalidSubjectCanonicalizationContext' in flow 'authn' -- Known
  state ids are 'array<String>['AuthenticationSetup', 'TestForSession',
  'SessionExists', 'FilterFlows', 'SelectAuthenticationFlow',
  'CallAuthenticationFlow', 'CallSubjectCanonicalization',
  'DetectIdentitySwitch', 'HandleIdentitySwitch', 'FinalizeAuthentication',
  'UpdateSessionWithAuthenticationResult', 'proceed',
  'AuthenticationException', 'IdentitySwitch', 'InputOutputError',
  'InvalidCredentials', 'InvalidProfileContext', 'InvalidSubjectContext',
  'NoCredentials', 'NoPassive', 'NoPotentialFlow', 'RequestUnsupported',
  'ReselectFlow', 'RuntimeException', 'SubjectCanonicalizationError',
  'LogRuntimeException']'
   at org.springframework.webflow.engine.Flow.getStateInstance(Flow.java:342)