InvalidNameIDPolicy occurs when using multi-factor authentication

[Nate Klingenstein]

Noriyuki,

It's not the principal type that's the problem.  It's the actual principal name that you're getting out of the authentication process.  It's probably different for MFA or Password, and the principal name that you get out of MFA process is probably different than the principal name that you're getting out of the Password process alone.  This depends totally on how you wrote the MFA script.  I believe the log should clearly show the principal name that it's using for both LDAP queries, and the Password one successfully matches an ImmutableID, and the MFA one doesn't.

Hope this helps,
Nate.