Using quay.io/keycloak/keycloak:26.5.5.

I have a SAML Identity Provider and OIDC (both) configured in Keycloak. The flow I want:

First login via external IdP:
1. User authenticates at external IdP
2. Keycloak creates or links the user
3. User accepts Terms and Conditions
4. User configures OTP
5. User reaches the client application

Later logins via the same external IdP:
1. User authenticates at external IdP
2. Keycloak requires OTP
3. User reaches the client application

I tried using an Identity Provider Post login flow with a conditional OTP flow:

aai-otp-postlogin
└── Conditional OTP                  Conditional
    ├── Condition - user configured  Required
    └── OTP Form                     Alternative

I also tried variants with OTP Form set to Required, and with an additional Condition - user attribute checking whether the Terms and Conditions attribute exists.

However, for a brand-new brokered user, the post-login flow fails before the user can complete the Configure OTP required action. The Keycloak logs show:

IDENTITY_PROVIDER_POST_LOGIN_ERROR
error="invalid_user_credentials"
userId="null" 

If I set the Identity Provider Post login flow to None, first login works correctly: the user is created, Terms and Conditions are shown, Configure OTP is shown, and the user reaches the application. But then later logins through the external IdP do not get an OTP challenge.

In Authentication->Required actions i have Configure OTP enabled and set as default action (both on).

My question: Is there a built-in way in Keycloak 26.5.5 to express this logic for brokered logins? Any guidance on the recommended flow structure would be appreciated.