Sigh. I re-read the man pages yet again (honestly, I'd read them three times to get the syntax and examples right.) Someone I'd missed every bleeding time that the authenticator must be in a particular path. (INN really ought to log that an authenticator wasn't found!)