Keycloak lets you pick a login option that's guaranteed to fail — here's the fix

Project: keycloak/keycloak — the identity and access management server. PR: #51021, fixing #46481.

The bug: if you write a custom Keycloak Authenticator that isn't a CredentialValidator — anything that isn't a password, OTP, WebAuthn, that kind of thing — and it requires a user to already be identified, Keycloak's "Try another way" screen will offer it as an option even when it isn't actually usable for that user. Pick it, and you get an immediate CREDENTIAL_SETUP_REQUIRED error. The option shouldn't have been on the screen in the first place.

Root cause, traced through two files in the services module:

AuthenticationSelectionResolver#addSimpleAuthenticationExecution decides what goes on the selection list. It only checks one thing:

Authenticator localAuthenticator = processor.getSession().getProvider(Authenticator.class, execution.getAuthenticator());