rmartinc · Oct 26, 2026
@@ -154,6 +154,7 @@ public void requiredActionChallenge(RequiredActionContext context) {
             // skip and clear UPDATE_EMAIL required action if email is readonly
             if (profile.getAttributes().isReadOnly(UserModel.EMAIL)) {
                 user.removeRequiredAction(UserModel.RequiredAction.UPDATE_EMAIL);
+                context.ignore();
                 return;
             }
 
@@ -179,12 +180,15 @@ public void requiredActionChallenge(RequiredActionContext context) {
                     context.challenge(context.form().createResponse(UserModel.RequiredAction.UPDATE_EMAIL));
                 }
             }
+        } else {
+            context.ignore();
         }
     }
 
     @Override
     public void processAction(RequiredActionContext context) {
         if (!isEnabled(context.getRealm())) {
+            context.success();
             return;
         }
         MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();

@@ -63,10 +63,13 @@ private boolean isReadOnlyFederatedUser(RequiredActionContext context) {
 
     @Override
     public void requiredActionChallenge(RequiredActionContext context) {
+        context.getUser().removeRequiredAction(getId());
+        context.ignore();
     }
 
     @Override
     public void processAction(RequiredActionContext context) {
+        context.success();
     }
    
     @Override

@@ -1461,17 +1461,7 @@ private static Response executeAction(KeycloakSession session, AuthenticationSes
 
         actionProvider.requiredActionChallenge(context);
 
-        if (context.getStatus() == RequiredActionContext.Status.FAILURE) {
-            LoginProtocol protocol = context.getSession().getProvider(LoginProtocol.class, context.getAuthenticationSession().getProtocol());
-            protocol.setRealm(context.getRealm())
-                    .setHttpHeaders(context.getHttpRequest().getHttpHeaders())
-                    .setUriInfo(context.getUriInfo())
-                    .setEventBuilder(event);
-            Response response = protocol.sendError(context.getAuthenticationSession(), Error.CONSENT_DENIED, null);
-            event.error(Errors.REJECTED_BY_USER);
-            return response;
-        }
-        else if (context.getStatus() == RequiredActionContext.Status.CHALLENGE) {
+        if (context.getStatus() == RequiredActionContext.Status.CHALLENGE) {
             authSession.setAuthNote(AuthenticationProcessor.CURRENT_AUTHENTICATION_EXECUTION, model.getProviderId());
             return context.getChallenge();
         }
@@ -1487,9 +1477,17 @@ else if (context.getStatus() == RequiredActionContext.Status.SUCCESS) {
             authSession.removeRequiredAction(factory.getId());
             setKcActionStatus(factory.getId(), RequiredActionContext.KcActionStatus.SUCCESS, authSession);
             return nextActionAfterAuthentication(session, authSession, session.getContext().getConnection(), request, session.getContext().getUri(), event, ignoredActions);
+        } else {
+            // manage any other status as failure just in case
+            LoginProtocol protocol = context.getSession().getProvider(LoginProtocol.class, context.getAuthenticationSession().getProtocol());
+            protocol.setRealm(context.getRealm())
+                    .setHttpHeaders(context.getHttpRequest().getHttpHeaders())
+                    .setUriInfo(context.getUriInfo())
+                    .setEventBuilder(event);
+            Response response = protocol.sendError(context.getAuthenticationSession(), Error.CONSENT_DENIED, null);
+            event.error(Errors.REJECTED_BY_USER);
+            return response;
         }
-
-        return null;
     }
 
     private static RequiredActionProviderModel getFirstApplicableRequiredAction(final RealmModel realm,

@@ -25,6 +25,7 @@
 import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.models.credential.OTPCredentialModel;
 import org.keycloak.models.credential.PasswordCredentialModel;
+import org.keycloak.models.utils.DefaultRequiredActions;
 import org.keycloak.models.utils.TimeBasedOTP;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testframework.events.EventAssertion;
@@ -93,6 +94,9 @@ public class RequiredActionPriorityTest extends AbstractTestRealmKeycloakTest {
     @Page
     protected LoginConfigTotpPage totpPage;
 
+    @Page
+    protected LoginConfigTotpPage configureTotpRequiredActionPage;
+
     private String testUserId;
 
     @Before
@@ -440,8 +444,30 @@ public void skipToNextRequiredActionWithCustomPriority() {
         EventAssertion.assertSuccess(events.poll()).type(EventType.UPDATE_CREDENTIAL);
     }
 
+    @Test
+    public void setupTotpAfterUpdateUserLocale() throws Exception {
+        // change order to have update user locale before otp and assign them to the customer
+        final List<String> requiredActionsCustomOrdered = List.of(
+                DefaultRequiredActions.Action.UPDATE_USER_LOCALE.getAlias(),
+                DefaultRequiredActions.Action.CONFIGURE_TOTP.getAlias()
+        );
+        AdminApiUtil.updateRequiredActionsOrderByAlias(managedRealm.admin(), requiredActionsCustomOrdered);
+
+        enableRequiredActionForUser(DefaultRequiredActions.Action.UPDATE_USER_LOCALE.getAlias());
+        enableRequiredActionForUser(DefaultRequiredActions.Action.CONFIGURE_TOTP.getAlias());
+
+        // Login and check OTP is shown to be configured
+        oauth.openLoginForm();
+        loginPage.login(USERNAME, PASSWORD);
+        configureTotpRequiredActionPage.assertCurrent();
+    }
+
     private void enableRequiredActionForUser(final RequiredAction requiredAction) {
-        setRequiredActionEnabled(TEST_REALM_NAME, testUserId, requiredAction.name(), true);
+        enableRequiredActionForUser(requiredAction.name());
+    }
+
+    private void enableRequiredActionForUser(final String requiredAction) {
+        setRequiredActionEnabled(TEST_REALM_NAME, testUserId, requiredAction, true);
     }
 
 }