Required Action bypasses authentication

[gsantosamn]

Hello, I am using this extension together with the Required Action to enter the mobile number : https://github.com/dasniko/keycloak-extensions-demo/tree/main/requiredaction .

The steps I want are simple :

1. user+password auth
2. Required Action kicks in IF the mobile_number is not present in the user attributes, asking user to enter number,
3. "2FA SMS Authenticator" starts as normal, being sure the number is set.

But it does not work. After entering the mobile_number in the Required Action form and clicking "Submit", the user is authenticated !!

It seems the Required Action bypasses the "2FA SMS Authenticator" entirely and just authenticates the user. I really do not know why this happens

[dasniko]

It works like designed.
As the user doesn't have yet a mobile number configured, the 2fa authenticator activates the required action, thus the authenticator is finished. Required actions always are executed after an authentication flow, so after executing the action, the user is authenticated. This is by core design of keycloak.

Please note that my examples are exactly that: examples!
If you want to have another behaviour, e.g. that the user has to confirm the mobile number, you have to implement it on your own into the required action.

[gsantosamn]

Ok I understand now, I had not understood that Required Actions were executed after the authenticator, thus effectively "canceling" it.

How I see it is the only way to have the behaviour I want is to not use the Required Action, and just have all the logic in the authenticator. I will implement this.

Thank you for your answer