---
realm: ccchh
alias: browser passkey and token
description: passkey or (password and (TOTP or token))
providerId: basic-flow
authenticationExecutions:
  - providerId: auth-cookie
    requirement: ALTERNATIVE
  - providerId: auth-spnego
    requirement: DISABLED
  - providerId: identity-provider-redirector
    requirement: ALTERNATIVE
  - subFlow: browser passkey and token browser passkey Organization
    requirement: DISABLED
    authenticationExecutions:
      - subFlow: browser passkey and token browser passkey Browser - Conditional Organization
        requirement: CONDITIONAL
        authenticationExecutions:
          - providerId: conditional-user-configured
            requirement: REQUIRED
          - providerId: organization
            requirement: ALTERNATIVE
  - subFlow: browser passkey and token browser passkey forms
    requirement: ALTERNATIVE
    authenticationExecutions:
      - subFlow: browser passkey and token Passkey or Password
        requirement: REQUIRED
        authenticationExecutions:
          - providerId: webauthn-authenticator-passwordless
            requirement: ALTERNATIVE
          - subFlow: browser passkey and token Password + OTP
            requirement: ALTERNATIVE
            authenticationExecutions:
              - providerId: auth-username-password-form
                requirement: REQUIRED
              - subFlow: browser passkey and token Conditional OTP
                requirement: CONDITIONAL
                authenticationExecutions:
                  - providerId: conditional-credential
                    requirement: REQUIRED
                    authenticationConfig:
                      alias: browser passkey and token not passkey
                      config:
                        credentials: webauthn-passwordless
                        included: 'false'
                  - providerId: conditional-user-configured
                    requirement: REQUIRED
                  - providerId: auth-otp-form
                    requirement: REQUIRED
              - subFlow: WebAuthn Authenticator if configured for the user
                requirement: CONDITIONAL
                authenticationExecutions:
                  - providerId: conditional-credential
                    requirement: REQUIRED
                    authenticationConfig:
                      alias: webauthn-passwordless
                      config:
                        credentials: webauthn-passwordless
                  - providerId: conditional-user-configured
                    requirement: REQUIRED
                  - providerId: webauthn-authenticator
                    requirement: REQUIRED