Enforce-MFA doesn’t work as expected when used in post login flow

[jirutka]

I’ve configured it exactly as described in the readme, but I use this authentication flow as the Identity Provider’s post login flow.

- MFA Wrapper Flow
-- MFA-Authenticate-subflow CONDITIONAL
--- Condition - user configured REQUIRED
--- OTP ALTERNATIVE
--- WebAuthn ALTERNATIVE

-- Register-MFA-subflow CONDITIONAL
--- Condition - user configured REQUIRED
--- Enforce-MFA REQUIRED

Even when the user has Passkeys enrolled, Keycloak always shows them the Enforce-MFA page with the selection of 2FA methods to configure.

[melegiul]

but I use this authentication flow as the Identity Provider’s post login flow.

Thanks for your report. Could you please explain what that means? Or even better provide the full authentication flow setup?