# Required actions execution order (session and user required actions)

**URL:** <https://forum.keycloak.org/t/required-actions-execution-order-session-and-user-required-actions/10689>\
**Category:** Getting advice\
**Created:** [August 25, 2021, 2:11pm UTC](https://forum.keycloak.org/t/required-actions-execution-order-session-and-user-required-actions/10689 "2021-08-25T14:11:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rd-mara-hegemann](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rd-mara-hegemann/32/3761_2.png) [@rd-mara-hegemann](https://forum.keycloak.org/u/rd-mara-hegemann)\
**Post date:** [August 25, 2021, 2:11pm UTC](https://forum.keycloak.org/t/required-actions-execution-order-session-and-user-required-actions/10689/1 "2021-08-25T14:11:38Z")

</div>

Hi, when I configured some required actions like so:

- password reset (priority 1)
- verify email (priority 2)
- terms and conditions (priority 3)

When the user triggers a password reset (via forgot password) I expect the following order:

| action | context |
| --- | --- |
| password reset | session |
| verify email | user |
| terms and conditions | user |

but instead they execute in the following order:

| action | context |
| --- | --- |
| verify email | user |
| terms and conditions | user |
| password reset | session |

This seems like a bug to me and I looked into the code and it seems to go  
wrong [here](https://github.com/keycloak/keycloak/blob/5fe675b6128fffa6173209adaa2c742075cb35b5/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java#L1101-L1107)

```java
Stream<String> requiredActions = user.getRequiredActionsStream();
// Here all the user required actions are executed, even if there are higher priority actions stored in the session...
Response action = executionActions(session, authSession, request, event, realm, user, requiredActions);
if (action != null) return action;

//... which are executed afterwards
action = executionActions(session, authSession, request, event, realm, user, authSession.getRequiredActions().stream());
if (action != null) return action;

```

One potential way of fixing this would be to concatenate user required actions and session required actions to execute them in one step.  
The only obvious difference would be, that we can’t return early after executing the user actions, but I don’t understand when that is actually desired.  
Could you provide some context and would you like me to prepare a PR?

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [August 25, 2021, 3:32pm UTC](https://forum.keycloak.org/t/required-actions-execution-order-session-and-user-required-actions/10689/2 "2021-08-25T15:32:35Z")

</div>

This is a community forum, chances that Keycloak team members will read here are low.  
Your question would perhaps better be asked at the [Keycloak developer mailing list](https://groups.google.com/forum/#!forum/keycloak-dev/join).

---

<div class="post-metadata">

**Author:** ![rd-mara-hegemann](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rd-mara-hegemann/32/3761_2.png) [@rd-mara-hegemann](https://forum.keycloak.org/u/rd-mara-hegemann)\
**Post date:** [August 30, 2021, 7:44am UTC](https://forum.keycloak.org/t/required-actions-execution-order-session-and-user-required-actions/10689/3 "2021-08-30T07:44:46Z")

</div>

Thanks for your advice!  
More informations can be found [here](https://groups.google.com/g/keycloak-dev/c/MqpYd7kKa3U)