title: Keycloak 2 conditional authenticators
body: <p>In my Keycloak authentication flow, there are two authenticators at the end - SMS (text message) or OTP form. The SMS authenticator is mine, the OTP one is the builtin one that comes with Keycloak. I thought I would put them both into a subflow with mine first and mark them as &quot;alternative&quot;. Earlier in the flow, the user has made a choice about which authenticator to use. In the SMS authenticator <code>authenticate()</code> method, I check if the user has not chosen it and call <code>context.attempted()</code>, thinking that the flow will continue on to the OTP form. When I do that though, I'm getting this in the log:</p>
  <p><code>18:26:00,732 WARN  [org.keycloak.services] (default task-1) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:944)</code> etc (full stack trace)</p>
  <p>The flow does not continue to the OTP form. and the user just gets a message that authentication has failed. It actually displays &quot;Invalid username or password&quot;</p>
  <p>Question: Is this how to setup this flow (see attached)? The subflow is required, but the authenticators in the subflow are alternative.</p>
  <p>Another question: Is there a way in code to disable the find and disable an authenticator  so it's authenticate() method wont even be called?</p>
  <p><a href="https://i.stack.imgur.com/6RPPz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/6RPPz.png" alt="enter image description here" /></a></p>