SPNEGO as first factor in MFA

[Simon Lundström]

On Fri, 2025-03-28 at 19:08:42 +0100, Rabe, Jens via users wrote:
>[...]
> And it works but if i authenticate at the service provide that requested the forceAuthn and after successful login i try to login at a service provide with SPNEGO and that fails with "Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail".

Did you set:
idp.authn.SPNEGO.forcedAuthenticationSupported = true
like I wrote in https://marc.info/?l=shibboleth-users&m=174238364408577&w=2
?

I picked different keys in my nextFlowStrategyMap but I'm not sure
that's it.

BR,
- Simon