Trouble implementing multi-stage authentication (AD + Duo)

I'm trying to implement an unusual multi-stage, multi-factor authentication process, and I'm getting hung up for reasons that aren't clear to me.   Here's the existing, and working, system: The us...