My two cents: I implemented all the above. But it was still not working. Later I found that it works with a built in userflow and not custom policies.