🔐 enhanced-authflows: Keycloak admin theme for smoother authentication flow editing

Keycloak admin console theme (enhanced-authflows) focused on authentication flows: local drafts on the execution tree, JSON export and import, sibling reordering, validation feedback, sub-flow reparenting, and table or diagram views. It is a theme, not a Java SPI; install it like any other admin theme JAR (see Install).

👥 Audience: operators and realm admins who move authentication flows between realms or environments using JSON export and import in the console, and who want structural edits on the tree grouped behind one explicit Save so routine flow work stays predictable in the UI.

✨ What this theme changes

✏️ Draft-first editing on the flow detail page

Most structural edits on the execution tree (order, requirements, sub-flow title and description, authenticator config, staged removals, queued additions) stay in a local draft until Save or Cancel. That reduces accidental half-applied states and makes multi-step edits easier to reason about.

• 📤 JSON export and import

  • Realm, Authentication: export or import root flows from the flows list.
  • Flow detail page: export the full tree or a single sub-flow subtree; import a realm-style bundle with attach options (where the graph should land in your realm), prefix or suffix conflict handling, optional per-flow target alias overrides, and guards when the file only contains nested flows (sub-flow-only import blockers are explained in the UI).

• 💾 Explicit Save
  Save applies the draft to the Admin API in a stable sequence: order sync, requirements, authenticator configs, pending executions and sub-flows, then any follow-up ordering. Cancel drops local changes and reloads the flow from the server.

• 📂 Collapsed sub-flows stay collapsed
  After Save or Cancel, expand and collapse state is restored from your last view so large trees stay easy to scan.

• ⬆️⬇️ Sibling ordering with arrows
  Move executions among siblings with up/down controls. Moves that would violate Keycloak rules are blocked in the UI.

• 🛡️ Invalid sibling requirements are surfaced
  When the same sibling group mixes ALTERNATIVE with REQUIRED or CONDITIONAL for the rows Keycloak actually evaluates, requirement controls are highlighted and save stays disabled until the conflict is resolved.

• 👁️ DISABLED executions are easy to spot
  Rows whose requirement is DISABLED use a muted treatment in the table so skimming a long flow is less noisy.

• 🔗 Reparent sub-flows
  An extra column opens a modal to move a sub-flow under another parent in the same realm.

📦 Install

1. 📥 Download the JAR for your Keycloak version from GitHub Releases (example artifact: keycloak-enhanced-authflows-ui-<release>-keycloak-26.6.1.jar).
2. 📦 Copy the JAR into providers/ next to your other providers.
3. 🔧 Run kc.sh build and start Keycloak as usual.
4. 🎨 In the admin console: Realm settings, Themes, Admin console theme, set to enhanced-authflows. Use realm master if you theme the console itself. Hard-reload the admin UI if it stays cached (CTRL+ALT+R)

🧪 Development

See dev/README.md.

📷 Screenshots