Browser authentication flows with keberos and otp form #45773

marlenekoh · 2026-01-27T01:30:28Z

marlenekoh
Jan 27, 2026

I am on Keycloak v23.0.7

Seeking advice on how to achieve the following browser authentication flow:

(Requirement A) Try kerberos. If kerberos succeeds, prompt for OTP
(Requirement B) If kerberos fails, fallback to username password form. If username password form succeeds, prompt for OTP.

# Attempt 1
.
├── Cookie (Alternative)
├── Identity Provider Redirector (Alternative)
├── >> Required Auth Sub Flow (Required)
│   ├── Kerberos (Alternative)
│   └── Username Password Form (Alternative)
└── >> Required 2FA Sub Flow (Required)
    ├── Condition - user configured (Required)
    └── OTP Form (Required)

However, this does not solve requirement A, since Username Password Form is fixed at Required and cannot be changed to Alternative.

# Attempt 2
.
├── Cookie (Alternative)
├── Identity Provider Redirector (Alternative)
├── >> Alternative Kerberos Sub Flow (Alternative)
│   ├── Kerberos (Required)
│   ├── Condition - user configured (Required)
│   └── OTP Form (Required)
└── >> Alternative Username Password Sub Flow (Alternative)
    ├── Username Password Form (Required)
    ├── Condition - user configured (Required)
    └── OTP Form (Required)

This solves requirement A but not requirement B. if Kerberos fails, then I get an error message "Kerberos is not set up. You cannot login", even though Kerrberos is in an Alternative Sub Flow: https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/authentication/authenticators/browser/SpnegoAuthenticator.java#L127

# Attempt 3
.
├── Cookie (Alternative)
├── Identity Provider Redirector (Alternative)
├── >> Alternative Username Password Sub Flow (Alternative)
│   ├── Username Password Form (Required)
│   ├── Condition - user configured (Required)
│   └── OTP Form (Required)
└── >> Alternative Kerberos Sub Flow (Alternative)
    ├── Kerberos (Required)
    ├── Condition - user configured (Required)
    └── OTP Form (Required)

I swapped the sub flow order to try username password sub flow first. This creates a "Try Another Way" button in the Username Password Form. If I select that, then spnego, I get a "Page has expired" error.

Any help would be much appreciated, thank you!

Navigation Menu

Repository navigation

Browser authentication flows with keberos and otp form #45773

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Browser authentication flows with keberos and otp form #45773

Uh oh!

marlenekoh Jan 27, 2026

Replies: 0 comments

marlenekoh
Jan 27, 2026