I don't like the query param approach as it requires somehow adding the query param to specify what authenticators to skip. This would have to be added to applications themselves and with Keycloak the whole idea is that applications shouldn't have to worry about authentication semantics.
We need a generic mechanism to be able to skip any authenticators that automatically log in a user. Currently this is only Kerberos, but in the future we could add more, including an option to automatically route to external IdPs.
Ignoring implementation semantics for now, but taking Kerberos as the example authenticator I can see some options (in the example below replace 'Kerberos' with any other authentication method that can automatically login a user):
* If a user that was logged in using Kerberos logs out the user should not just be automatically logged-in again for the current browser session. Instead the user should be displayed with a regular username/password field, but also with an option to login with Kerberos
* A variant on the above where if a user has logged-out from Kerberos the user would be displayed with a "Is this you?" when login, if the user selects yes the Kerberos authenticator would continue, if not the regular username/password form would be displayed
* Implement account switcher - where a user can login to multiple accounts at a time and select which account to use
Other ideas? Points for ideas that requires no hacks in applications ;)