Set UPDATE_PASSWORD action under custom conditions: authenticator or event?

1

Hello

I have to assign users an update_password action under certain conditions not covered out of the box by Keycloak.
I see two ways of doing so:

  1. create a custom authenticator: more visible and easier to configure, but it complicates an already complicated authentication flow and I would have to add it on multiple flows, login flow and post authentication flows from external IdPs
  2. login event: set up once, but less visible and requires configurations in config file

Any other pros and cons I should consider?

Thanks!