Update to new manually created flow

resources/chaosknoten/keycloak/auth_flows/browser.yaml

@@ -1,62 +1,31 @@
 ---
 realm: ccchh
-alias: browser passkey and token
-description: passkey or (password and (TOTP or token))
+alias: passkey and 2FA
+description: Login flow with passkey and proper 2FA handling.
 providerId: basic-flow
 authenticationExecutions:
-  - providerId: auth-cookie
-    requirement: ALTERNATIVE
-  - providerId: auth-spnego
-    requirement: DISABLED
-  - providerId: identity-provider-redirector
-    requirement: ALTERNATIVE
-  - subFlow: browser passkey and token browser passkey Organization
-    requirement: DISABLED
+  - subFlow: pk2fa-login
+    requirement: REQUIRED
     authenticationExecutions:
-      - subFlow: browser passkey and token browser passkey Browser - Conditional Organization
-        requirement: CONDITIONAL
+      - providerId: auth-cookie
+        requirement: ALTERNATIVE
+      - subFlow: pk2fa-authentication
+        requirement: ALTERNATIVE
         authenticationExecutions:
-          - providerId: conditional-user-configured
+          - providerId: auth-username-password-form
             requirement: REQUIRED
-          - providerId: organization
-            requirement: ALTERNATIVE
-  - subFlow: browser passkey and token browser passkey forms
-    requirement: ALTERNATIVE
-    authenticationExecutions:
-      - subFlow: browser passkey and token Passkey or Password
-        requirement: REQUIRED
-        authenticationExecutions:
-          - providerId: webauthn-authenticator-passwordless
-            requirement: ALTERNATIVE
-          - subFlow: browser passkey and token Password + OTP
-            requirement: ALTERNATIVE
+          - subFlow: pk2fa-conditional-2fa
+            requirement: CONDITIONAL
             authenticationExecutions:
-              - providerId: auth-username-password-form
+              - providerId: conditional-credential
                 requirement: REQUIRED
-              - subFlow: browser passkey and token Conditional OTP
-                requirement: CONDITIONAL
-                authenticationExecutions:
-                  - providerId: conditional-credential
-                    requirement: REQUIRED
-                    authenticationConfig:
-                      alias: browser passkey and token not passkey
-                      config:
-                        credentials: webauthn-passwordless
-                        included: 'false'
-                  - providerId: conditional-user-configured
-                    requirement: REQUIRED
-                  - providerId: auth-otp-form
-                    requirement: REQUIRED
-              - subFlow: WebAuthn Authenticator if configured for the user
-                requirement: CONDITIONAL
-                authenticationExecutions:
-                  - providerId: conditional-credential
-                    requirement: REQUIRED
-                    authenticationConfig:
-                      alias: webauthn-passwordless
-                      config:
-                        credentials: webauthn-passwordless
-                  - providerId: conditional-user-configured
-                    requirement: REQUIRED
-                  - providerId: webauthn-authenticator
-                    requirement: REQUIRED
+                authenticationConfig:
+                  alias: pk2fa-conditional-2fa-passwordless-conditional
+                  config:
+                    credentials: webauthn-passwordless
+              - providerId: conditional-user-configured
+                requirement: REQUIRED
+              - providerId: webauthn-authenticator
+                requirement: ALTERNATIVE
+              - providerId: auth-otp-form
+                requirement: ALTERNATIVE