Problems getting basic MFA example to work

[Oluf Færø]

Hi,

I am trying to get a basic MFA authentication configuration to work.

In this configuration I would like the MFA configuration to first run the IPAddress flow followed by the Password authentication flow.

In idp.properties I have made the following changes

     idp.authn.flows= MFA
     idp.authn.flows.initial = MFA

In mfa-authn-config.xml I have made the following configuration of the TransitionMap

    <util:map id="shibboleth.authn.MFA.TransitionMap">
        <!-- First rule runs the IPAddress login flow. -->
        <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/IPAddress" />
        </entry>
        <entry key="authn/IPAddress">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />
        </entry>
        <!-- An implicit final rule will return whatever the final flow returns. -->
    </util:map>

But when I use this configuration I get the following message in the log file 

2017-12-14 12:43:17,494 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:129] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/MFA to intermediate set
2017-12-14 12:43:17,495 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:294] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed

And my service provider displays the following error message

	opensaml::FatalProfileException
	The system encountered an error at Thu Dec 14 12:51:17 2017
	To report this problem, please contact the site administrator at root at localhost.
	Please include the following message in any email:
	opensaml::FatalProfileException at (https://myidphostname/Shibboleth.sso/SAML2/POST)

	SAML response reported an IdP error.

	Error from identity provider:
	Status: urn:oasis:names:tc:SAML:2.0:status:Requester
	Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
	Message: An error occurred.

What part of the configuration am I missing ?