Real meaning of "No potential flows left to choose from"

[Francesco Malvezzi]

> 
> [...]
>> 
>> If you're using X.509 authentication, then you would have to have
>> enabled either the built-in x509 c14n flow (and configured it) or you
>> would have to supply something else, but the "simple" flow that's
>> enabled by default won't work, it doesn't know how to operate on that
>> kind of Subject result.
> 
> the flow named X509External [1] is actually a workaround to use X509 in
> a apache2/jetty environment and it produces a plain UsernamePrincipal so
> I think "simple" flow would be enough,

Actually the second flow inside the mfa sets a second (and different)
UsernamePrincipal. And I didn't bother to erase the first one because I
was assuming the substitution was automagic.

Was I wrong?

If I was wrong, I can understand "simple" c14n strategy fails: according
to documentations, it expects exactly one UsernamePrincipal,

ciao,

Francesco