Real meaning of "No potential flows left to choose from"

[Cantor, Scott]

> Actually the second flow inside the mfa sets a second (and different)
> UsernamePrincipal. And I didn't bother to erase the first one because I
> was assuming the substitution was automagic.
> 
> Was I wrong?

Yes. How could it know which one is "right"? This is essentially why the whole mechanism exists, even though it's somewhat overly complex at first glance. In the "normal" case you can usually ignore it, but this is exactly when "normal" doesn't apply. Two flows producing completely different names, and you have to reconcile that.

You can do it in c14n or you can do it with a custom result merging function at the end of the MFA flow. The custom function is in some sense a kind of c14n, but it's more generic since it's responsible for producing the entire Subject and is specific to the MFA case.

> If I was wrong, I can understand "simple" c14n strategy fails: according
> to documentations, it expects exactly one UsernamePrincipal,

Exactly. Now, it probably can be enhanced to handle the case where all of them are the same username, that just got overlooked, but makes sense to fix.

-- Scott