Hi guys, in the UpdatePassword class we need to modify the string values that come from formData so that there are not "password-new" but "passwordNew" (JS conform as we've build the GUI with AngularJS on top of Freemarker actions): https://github.com/keycloak/keycloak/blob/de472dbd43dd2767afb3436835f7792... We've created our own CustomUpdatePassword (similar with the class above except the two lines and own id -UPDATE_PASSWORD_CUSTOM) and tried to hook it in our own custom ResetPassword class: @Override public void authenticate(AuthenticationFlowContext context) { if (context.getExecution().isRequired() || (context.getExecution().isOptional() && configuredFor(context))) { context.getClientSession().addRequiredAction(CustomUpdatePassword.UPDATE_PASSWORD_CUSTOM); } context.success(); } The custom classes are registered in META-INF services and everything, and we can add the custom reset password execution in the Reset Credentials workflow... The result is a NPE in AuthenticationManager by trying to get the providerId from the model RequiredActionProviderModel model = realm.getRequiredActionProviderByAlias(action); RequiredActionFactory factory = (RequiredActionFactory)session.getKeycloakSessionFactory().getProviderFactory(RequiredActionProvider.class, model.getProviderId()); I am tired and cannot look through anymore, so your advice is more than welcomed... Thanks, Adrian