mesutpiskin/keycloak-2fa-email-authenticator v26.4.3

v26.4.3 — fix: configuredFor enrolment gate, skipSetup opt-in restored

on GitHub

Fix: gate configuredFor on enrolment and restore skipSetup opt-in

Closes a follow-up regression on issue #108 reported by @hashworks: with v26.4.2, users were prompted for the email OTP form even when the Conditional - User Configured sub-flow's conditions weren't met.

Root cause

PR #136 made EmailAuthenticatorForm.configuredFor return true for any user with an email address. Keycloak's Conditional - User Configured iterates sibling executions and calls configuredFor on each, so non-enrolled users were unexpectedly satisfying the condition.

What changed

• EmailAuthenticatorForm.configuredFor now returns true when either the user has a stored email-authenticator credential or an admin has explicitly opted in by setting skipSetup=true on at least one email-authenticator execution in the realm and the user has an email.
• EmailAuthenticatorCredentialProvider is untouched — the architectural cleanup from #129 and the empty userCredentialMetadatas behaviour from #108 are preserved.
• The skipSetup config property is re-exposed in the admin UI with help text that calls out the trade-off, and EmailConstants.SKIP_SETUP / DEFAULT_SKIP_SETUP are un-deprecated. The default flips from true to false.

When to flip skipSetup

Backward compatibility

• Realms upgrading from v26.3.1 / v26.4.1 with explicit skipSetup=false (e.g. @hashworks' setup) get the strict behaviour back without reconfiguration.
• Realms upgrading from v26.4.2 default behaviour need to set skipSetup=true on the execution if they were relying on the permissive default.

Pull request

• #137: fix: restore skipSetup opt-in and gate configuredFor on enrolment (#108 follow-up)