Good morning,
For alternative flows like X509 browser, if something goes wrong
it will fall back to username/password form, as we already know.
But the flow is not executed again until the browser is closed.
Based on what Stian commented[1], seems like the same applies to
Kerberos. To fix this, we need to change the way how it works today,
by going through the list of all alternative flows on refresh,
executing them again.
Does it make sense? Should we have Jira as "enhancement" for this?
[1] -
https://issues.jboss.org/browse/KEYCLOAK-5466
--
abstractj