Real meaning of "No potential flows left to choose from"

[Francesco Malvezzi]

[...]
> 
> If you're using X.509 authentication, then you would have to have
> enabled either the built-in x509 c14n flow (and configured it) or you
> would have to supply something else, but the "simple" flow that's
> enabled by default won't work, it doesn't know how to operate on that
> kind of Subject result.

the flow named X509External [1] is actually a workaround to use X509 in
a apache2/jetty environment and it produces a plain UsernamePrincipal so
I think "simple" flow would be enough,

thank you for all explanations, the c14n subject is really fascinating,
I have to study it more,

Francesco

[1] https://github.com/francescm/idp3-x509-external-auth