diff --git a/internal/outpost/flow/const.go b/internal/outpost/flow/const.go
new file mode 100644
index 0000000000..3ebcb94341
--- /dev/null
+++ b/internal/outpost/flow/const.go
@@ -0,0 +1,15 @@
+package flow
+
+type StageComponent string
+
+const (
+	StageIdentification        = StageComponent("ak-stage-identification")
+	StagePassword              = StageComponent("ak-stage-password")
+	StageAuthenticatorValidate = StageComponent("ak-stage-authenticator-validate")
+	StageAccessDenied          = StageComponent("ak-stage-access-denied")
+)
+
+const (
+	HeaderAuthentikRemoteIP     = "X-authentik-remote-ip"
+	HeaderAuthentikOutpostToken = "X-authentik-outpost-token"
+)
diff --git a/internal/outpost/flow.go b/internal/outpost/flow/executor.go
similarity index 93%
rename from internal/outpost/flow.go
rename to internal/outpost/flow/executor.go
index f19d22b0ad..807e576f49 100644
--- a/internal/outpost/flow.go
+++ b/internal/outpost/flow/executor.go
@@ -1,4 +1,4 @@
-package outpost
+package flow
 
 import (
 	"context"
@@ -19,8 +19,6 @@ import (
 	"goauthentik.io/internal/outpost/ak"
 )
 
-type StageComponent string
-
 var (
 	FlowTimingGet = promauto.NewHistogramVec(prometheus.HistogramOpts{
 		Name: "authentik_outpost_flow_timing_get",
@@ -32,18 +30,6 @@ var (
 	}, []string{"stage", "flow", "client", "user"})
 )
 
-const (
-	StageIdentification        = StageComponent("ak-stage-identification")
-	StagePassword              = StageComponent("ak-stage-password")
-	StageAuthenticatorValidate = StageComponent("ak-stage-authenticator-validate")
-	StageAccessDenied          = StageComponent("ak-stage-access-denied")
-)
-
-const (
-	HeaderAuthentikRemoteIP     = "X-authentik-remote-ip"
-	HeaderAuthentikOutpostToken = "X-authentik-outpost-token"
-)
-
 type FlowExecutor struct {
 	Params  url.Values
 	Answers map[StageComponent]string
@@ -183,7 +169,7 @@ func (fe *FlowExecutor) solveFlowChallenge(depth int) (bool, error) {
 			}
 		}
 		if deviceChallenge == nil {
-			return false, errors.New("got ak-stage-authenticator-validate without duo")
+			return false, errors.New("no compatible authenticator class found")
 		}
 		devId, err := strconv.Atoi(deviceChallenge.DeviceUid)
 		if err != nil {
diff --git a/internal/outpost/ldap/bind/direct/direct.go b/internal/outpost/ldap/bind/direct/direct.go
index ba5e91a3fb..4ddf4f2576 100644
--- a/internal/outpost/ldap/bind/direct/direct.go
+++ b/internal/outpost/ldap/bind/direct/direct.go
@@ -11,7 +11,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	log "github.com/sirupsen/logrus"
 	"goauthentik.io/api"
-	"goauthentik.io/internal/outpost"
+	"goauthentik.io/internal/outpost/flow"
 	"goauthentik.io/internal/outpost/ldap/bind"
 	"goauthentik.io/internal/outpost/ldap/flags"
 	"goauthentik.io/internal/outpost/ldap/metrics"
@@ -53,7 +53,7 @@ func (db *DirectBinder) GetUsername(dn string) (string, error) {
 }
 
 func (db *DirectBinder) Bind(username string, req *bind.Request) (ldap.LDAPResultCode, error) {
-	fe := outpost.NewFlowExecutor(req.Context(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{
+	fe := flow.NewFlowExecutor(req.Context(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{
 		"bindDN":    req.BindDN,
 		"client":    req.RemoteAddr(),
 		"requestId": req.ID(),
@@ -61,8 +61,8 @@ func (db *DirectBinder) Bind(username string, req *bind.Request) (ldap.LDAPResul
 	fe.DelegateClientIP(req.RemoteAddr())
 	fe.Params.Add("goauthentik.io/outpost/ldap", "true")
 
-	fe.Answers[outpost.StageIdentification] = username
-	fe.Answers[outpost.StagePassword] = req.BindPW
+	fe.Answers[flow.StageIdentification] = username
+	fe.Answers[flow.StagePassword] = req.BindPW
 
 	passed, err := fe.Execute()
 	if !passed {
@@ -152,7 +152,7 @@ func (db *DirectBinder) SearchAccessCheck(user api.UserSelf) *string {
 }
 
 func (db *DirectBinder) TimerFlowCacheExpiry() {
-	fe := outpost.NewFlowExecutor(context.Background(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{})
+	fe := flow.NewFlowExecutor(context.Background(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{})
 	fe.Params.Add("goauthentik.io/outpost/ldap", "true")
 	fe.Params.Add("goauthentik.io/outpost/ldap-warmup", "true")