[keycloak-dev] bugs and limitations in alternative flows

[Bill Burke]

User just came across this bug, (well I haven't tested it is a bug but 
pretty sure it is):

Inside the Browser flow we have
Username Password Form
2SV - sub flow required
                 OTP execution - alternative
                 SMS execution - alternative


Neither OTP or SMS challenge is returned and both are just skipped.

Another problem is that if we fixed the above problem there is no code that handles the case where both alternatives are not configured.  Finally, there is a limitation if all of this was fixed, what to do if both of these Authenticators are not configured?  How is the required action formed and executed?