Real meaning of "No potential flows left to choose from"

[Francesco Malvezzi]

hi all,

I need help to pinpoint the following error:

ERROR
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
Profile Action SelectSubjectCanonicalizationFlow: No potential flows
left to choose from, canonicalization will fail

First of all: what does it mean?
1) did I forget to populate the collection of available flows?
2) none of the available flows can be used with the given
SubjectCanonicalizationContext?

If the error comes after completing a mfa flow defined with

    <util:map id="shibboleth.authn.MFA.TransitionMap">
        <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition"
p:nextFlow="authn/X509External" />
        </entry>
        <entry key="authn/X509External">
            <bean parent="shibboleth.authn.MFA.Transition"
p:nextFlow="authn/accountlinking" />
        </entry>
    </util:map>

is it to blame the mfa flow or the last flow run by mfa
(auth/accountlinking, in this example)?

thank you,

Francesco