Set LoA / ACR (refeds.org/profile/mfa) for BOTH passkey and password+OTP paths — Condition gets disabled on passkey login #51044

MPIC-Thomas · 2026-07-20T15:08:05Z

MPIC-Thomas
Jul 20, 2026

Body

Keycloak version: 26.7

Goal: A browser flow used as a SAML IdP (upstream of an academic federation SP) where:

Password login → OTP required
Passkey login (webauthn-passwordless via Username Password Form conditional UI) → no OTP
In BOTH cases, the outgoing SAML assertion must contain AuthnContextClassRef = https://refeds.org/profile/mfa

Realm ACR-to-LoA mapping: MFA → https://refeds.org/profile/mfa → LoA 1
The SP client also has Minimum ACR Value = https://refeds.org/profile/mfa set.

What works:

Password + OTP works and the SP receives refeds.org/profile/mfa.
Passkey works and correctly skips OTP (via Condition - credential, credential=webauthn-passwordless, Included=Off).

The problem:

The MFA/ACR signal to the SP is ONLY produced by the Condition - Level of Authentication execution. I have confirmed that Minimum ACR Value on the client alone does NOT produce the assertion value — removing the LoA condition removes the MFA signal for all login paths.

When Condition - Level of Authentication is placed in the same conditional subflow as Condition - credential + OTP Form, the passkey login disables the whole subflow (because the credential condition evaluates false), so the LoA is never set → SP gets no MFA context on passkey logins.

When I put Condition - Level of Authentication alone in its own conditional subflow (to make it independent of the passkey/OTP logic), the passkey login fails with AuthenticationFlowException / invalid_user_credentials — the WebAuthn assertion itself succeeds (log shows credential_type=webauthn-passwordless, user_verification_checked=true), but the flow cannot complete because that subflow has no executing step after the condition.

Current flow:

multiple_mfa forms                 Alternative
 ├─ Username Password Form         Required
 └─ (conditional subflow)          Conditional
     ├─ Condition - credential     Required  (webauthn-passwordless, Included=Off)
     └─ OTP Form                   Required

Server log on the failing passkey attempt (LoA condition alone in its own conditional subflow):

WARN [org.keycloak.services] KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException
    at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:1088)
    at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:382)
    ...
WARN [org.keycloak.events] type="LOGIN_ERROR", realmName="mpic.de",
    clientId="https://sso.academiccloud.de/ssp", userId="null",
    error="invalid_user_credentials",
    credential_type="webauthn-passwordless",
    web_authn_authenticator_user_verification_checked="true",
    auth_method="saml",
    public_key_credential_id="<redacted>"

Note: the WebAuthn ceremony clearly succeeds (credential_type=webauthn-passwordless, user_verification_checked=true); the failure happens afterwards while completing the flow.

Question:

How can I set the LoA / ACR (refeds.org/profile/mfa) so it is applied on both the password+OTP path and the passkey path, given that:

a conditional subflow containing only Condition - Level of Authentication aborts the passkey login (no executing step after the condition), and
combining it with the passkey-dependent OTP logic disables it on passkey login?

Is there a supported executing step I can add to a "LoA-only" conditional subflow so it completes cleanly after a passkey assertion? Or does this hybrid (passkey + password/OTP + step-up LoA signal) currently require a custom SPI?

This looks closely related to the missing built-in conditional described in
#42350
("Built-in conditional: user already authenticated via WebAuthn/Passkey").

Any guidance on a supported configuration-only approach — or confirmation that an SPI is required — would be greatly appreciated.

darius-m · 2026-07-21T10:15:25Z

darius-m
Jul 21, 2026

Could you please provide the flows in the other scenarios you've mentioned trying? They could help others better understand the variations.

Regarding the conditionals with no executions, you should be able to use Allow Access to simply mark the flow as successful - https://www.keycloak.org/docs/latest/server_admin/index.html#explicitly-denyallow-access-in-conditional-flows. The source code mentions that it's used for the purpose you've described https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/authentication/authenticators/access/AllowAccessAuthenticator.java#L30.

0 replies

MPIC-Thomas · 2026-07-21T10:55:49Z

MPIC-Thomas
Jul 21, 2026
Author

Thanks a lot — the Allow Access authenticator is exactly the missing piece. I wasn't aware it existed and had assumed there was no "no-op" step to cleanly terminate a conditional subflow that only contains a condition. That was the whole reason the LoA-only subflow kept aborting on passkey logins.

Below are the flow variations I tried, in case they help others understand the problem space. Goal in all cases (Keycloak 26.7, used as a SAML IdP upstream of an academic federation SP):

Password login → OTP required
Passkey login (webauthn-passwordless, via the Username Password Form) → no OTP
Both paths must emit AuthnContextClassRef = https://refeds.org/profile/mfa (realm ACR-to-LoA mapping: MFA → https://refeds.org/profile/mfa → LoA 1)

Variant A — both conditions in one conditional subflow

multiple_mfa forms                     Alternative
 ├─ Username Password Form             Required
 └─ Conditional 2FA                     Conditional
     ├─ Condition - Level of Authentication  Required   (LoA 1)
     ├─ Condition - credential               Required   (webauthn-passwordless, Included=Off)
     └─ OTP Form                             Required

Result: Password path works (OTP + MFA context). Passkey path skips OTP correctly, BUT emits no MFA context — because Condition - credential evaluates false on passkey, the whole conditional subflow is disabled, so Condition - Level of Authentication never runs and the LoA is never set.

Variant B — LoA condition alone in its own conditional subflow (no executing step)

multiple_mfa forms                     Alternative
 ├─ Username Password Form             Required
 ├─ Set-LoA                             Conditional
 │   └─ Condition - Level of Authentication  Required
 └─ Skip-OTP                            Conditional
     ├─ Condition - credential               Required   (webauthn-passwordless, Included=Off)
     └─ OTP Form                             Required

Result: Password path works. Passkey path fails with AuthenticationFlowException / invalid_user_credentials. The WebAuthn assertion itself succeeds (log shows credential_type=webauthn-passwordless, web_authn_authenticator_user_verification_checked=true), but the flow cannot complete because the Set-LoA subflow has no executing step after the condition. This is the case your Allow Access tip solves.

Variant C — separate auth-method branches (passkey vs password+OTP as alternatives)

multiple_mfa forms                     Alternative
 └─ Conditional OTP                     Conditional
     ├─ Condition - Level of Authentication  Required
     └─ Auth Methods                         Required
         ├─ WebAuthn Passwordless Authenticator  Alternative
         └─ Password with OTP                     Alternative
             ├─ Username Password Form            Required
             └─ OTP Form                          Required

Result: Produced the log warning REQUIRED and ALTERNATIVE elements at same level! Those alternative executions will be ignored: [webauthn-authenticator-passwordless], so the standalone WebAuthn execution was silently ignored. (In practice the passkey login was actually being handled by the Username Password Form's built-in conditional-UI passkey support, not by this separate execution — so this separate execution was dead weight and also caused the misleading warning.)

Fix based on your suggestion (Variant B + Allow Access):

multiple_mfa forms                     Alternative
 ├─ Username Password Form             Required
 ├─ Set-LoA                             Conditional
 │   ├─ Condition - Level of Authentication  Required   (LoA 1)
 │   └─ Allow Access                          Required   ← the missing terminating step
 └─ Skip-OTP                            Conditional
     ├─ Condition - credential               Required   (webauthn-passwordless, Included=Off)
     └─ OTP Form                             Required

The idea: Set-LoA runs on both paths (the LoA condition is credential-independent), Allow Access terminates it cleanly so the passkey path no longer aborts, and the LoA is set for both password and passkey logins → both emit the MFA context. Skip-OTP remains credential-dependent and only triggers OTP on the password path.

I'll report back once I've tested both paths (checking the actual AuthnContextClassRef in the outgoing SAML assertion with SAML-tracer). Thanks again for pointing me to AllowAccessAuthenticator — that was the key insight.

0 replies

Navigation Menu

Repository navigation

Set LoA / ACR (refeds.org/profile/mfa) for BOTH passkey and password+OTP paths — Condition gets disabled on passkey login #51044

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Set LoA / ACR (refeds.org/profile/mfa) for BOTH passkey and password+OTP paths — Condition gets disabled on passkey login #51044

Uh oh!

MPIC-Thomas Jul 20, 2026

Body

Replies: 2 comments

Uh oh!

darius-m Jul 21, 2026

Uh oh!

MPIC-Thomas Jul 21, 2026 Author

MPIC-Thomas
Jul 20, 2026

darius-m
Jul 21, 2026

MPIC-Thomas
Jul 21, 2026
Author