If you hover over the tooltip (the tiny question mark) to the right of the flow selection list, this will describe what the
flow is and does.
The `Auth Type` column is the name of authentication or action that will be executed. If an authentication is indented
this means it is in a sub-flow and may or may not be executed depending on the behavior of its parent. The `Requirement`
column is a set of radio buttons which define whether or not the action will execute. Let's describe what each radio
button means:
Required::
This authentication execution must execute successfully. If the user doesn't have that type of authentication mechanism
configured and there is a required action associated with that authentication type, then a required action will be attached
to that account. For example, if you switch `OTP Form` to `Required`, users that don't have an OTP generator configured
will be asked to do so.
Optional::
If the user has the authentication type configured, it will be executed. Otherwise, it will be ignored.
Disabled::
If disabled, the authentication type is not executed.
Alternative::
This means that at least one alternative authentication type must execute successfully at that level of the flow.
This is better described in an example. Let's walk through the `browser` authentication flow.
. The first authentication type is `Cookie`. When a user successfully logs in for the first time, a session cookie is set.
If this cookie has already been set, then this authentication type is successful.
Since the cookie provider returned success and each execution at this level of the flow is _alternative_, no other execution is executed and this results in a successful login.
. Next the flow looks at the Kerberos execution. This authenticator is disabled by default and will be skipped.
. The next execution is a subflow called Forms. Since this subflow is marked as _alternative_ it will not be executed if the `Cookie` authentication type passed.
