Skip to content

Support custom required actions in add-required-action workflow step - #51556

Open
abhi763153 wants to merge 1 commit into
keycloak:mainfrom
abhi763153:issue-51415
Open

Support custom required actions in add-required-action workflow step#51556
abhi763153 wants to merge 1 commit into
keycloak:mainfrom
abhi763153:issue-51415

Conversation

@abhi763153

Copy link
Copy Markdown

Summary

The add-required-action workflow step currently resolves required actions using the UserModel.RequiredAction enum. This prevents custom required actions from being configured because they are not part of the enum.

This change resolves the configured required action by looking up the corresponding RequiredActionProviderModel using its alias. If the provider exists and is enabled, its alias is added to the user.

This preserves support for built-in required actions while also allowing custom required actions.

Testing

  • Created a custom required action (webauthn-register-passwordless) and configured it in a workflow.
  • Verified the required action is added to the user and executed during login.
  • Verified built-in required actions such as VERIFY_EMAIL continue to work.

Closes #51415

Look up required actions using the provider alias instead of the UserModel.RequiredAction enum. This allows workflows to add custom required actions while preserving support for built-in required actions.

Closes keycloak#51415

Signed-off-by: Abhishek Kamti <abhishekkamti723@gmail.com>
@abhi763153
abhi763153 requested a review from a team as a code owner August 8, 2026 11:46
Copilot AI balanced review requested due to automatic review settings August 8, 2026 11:46

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Extends workflow required-action resolution to support custom provider aliases.

Changes:

  • Resolves configured actions through realm providers.
  • Rejects missing or disabled providers.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

} catch (IllegalArgumentException e) {
log.warnv("Invalid required action {0} configured in {1}", stepModel.getConfig().getFirst(REQUIRED_ACTION_KEY),
AddRequiredActionStepProviderFactory.ID);
RequiredActionProviderModel provider = realm.getRequiredActionProviderByAlias(configuredAction);
Comment on lines +35 to +48
RequiredActionProviderModel provider = realm.getRequiredActionProviderByAlias(configuredAction);

if (provider == null) {
log.warnv("Required action {0} is not configured in realm {1}",
configuredAction, realm.getName());
return;
}

if (!provider.isEnabled()) {
log.warnv("Required action {0} is not enabled in realm {1}",
configuredAction, realm.getName());
return;
}
user.addRequiredAction(configuredAction);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Workflow add-required-action does not allow all available required actions

2 participants