Real meaning of "No potential flows left to choose from"

[Cantor, Scott]

On 3/1/17, 8:31 AM, "users on behalf of Francesco Malvezzi" <users-bounces at shibboleth.net on behalf of francesco.malvezzi at unimore.it> wrote:

> First of all: what does it mean?

Depends when it happens, but in the usual case of c14n after authentication it means that you didn't include in the c14n configuration any usable way to normalize the Subject down to a principal name.

> 1) did I forget to populate the collection of available flows?

The system populates the runtime with any flows you enable, they're just in a list bean in the subject-c14n file. They're all active and are tried in order until one works or they all fail.

> If the error comes after completing a mfa flow defined with

In 3.3, canonicalization happens at the end of every login flow and I documented that in the section on writing new ones when I made that adjustment. Inside MFA that means it can happen many times, after each login flow you run and then once more at the end of the MFA flow itself to produce the final result.
 
As a compatibility issue, the top-level authn flow will also detect if this c14n step hasn't happened and will do a final pass itself if it has to, but that's so older login flows that might have been done as plugins to older releases won't break. Any new login code should be designed to perform c14n at the end of their work and the authn flow will detect that and just skip that step.

If you're using X.509 authentication, then you would have to have enabled either the built-in x509 c14n flow (and configured it) or you would have to supply something else, but the "simple" flow that's enabled by default won't work, it doesn't know how to operate on that kind of Subject result.

> is it to blame the mfa flow or the last flow run by mfa
> (auth/accountlinking, in this example)?

Could be any or all of them, it depends when it fails.

-- Scott