TrustedDeviceCondition does not work when 2FA is required instead of conditional

[Eldainorn]

First of all thank you for all the work that you have done with this plugin. I downloaded it, tried it (did some minor changes to theme to accommodate to our company's UI). Additional change that I did was that I changed Authenticator Types in Credential configured condition to be single String value instead of Multivalued value since we only use 'otp' authenticator type. I configured new conditions and register trusted device step. I set the 2FA device registration step to be conditional. When I log into our backoffice with these settings everything works perfectly.

Next, I configure the 2FA device. I proceed to login again, I am prompted for OTP code. I enter OTP code and now this new "Trust this device for X days" popups. I confirm it and can log into out backoffice again normally.

I logout and try login again. Works like a charm, I am also not prompted to OTP code.

Now here is where it gets tricky. If I try setting the Browser - 2FA - Conditional OTP step in authentication flow to REQUIRED instead of CONDITIONAL the flow completely breaks apart.
I still get prompted for OTP code during login and also get prompted if I want to trust this device but for some reason these two steps get flipped. So first I am asked if I want to trust the device and only after that I am prompted for OTP code. Further, even if I select to trust the device, it won't actually matter since during next login I still get prompted for OTP code.

My question is - have you ever tried this flow with Browser - 2FA - Conditional OTP step set to REQUIRED and managed to make it work? I have tried several different approaches but have not found a solution (as of yet). Can you maybe point me what should be change OR is it even possible for this plugin to work with REQUIRED 2FA step?

Any help would be greatly appreciated. For reference, I am using Keycloak v20.0.3.

Here are examples of configuration

Authentication steps

[skydrinker-tox]

Hello @Eldainorn, I'm not sure what you're trying to achieve, but I almost sure that Conditional Authenticators are not evaluated if you are inside a REQUIRED flow. They are meant to be used at the beginning of a conditional flow to determine if the flow should be processed or not.
If your "Browser OTP Browser - Conditional OTP" is marked as REQUIRED, it will be processed, the conditional authenticators inside of it wil have no effect on the flow execution.
I don't understand how you could observed a inversion of execution order between your "Onyx OTP Form" step and the "Register Device" step, but the rest of your description is normal regarding the flow you've created.

If you're still trying to do something with that plugin and need help, you can ask your question here.