I have this adaptive authentication procedure for WSO2 Identity Server:

1. step. authenticate user with X509Certificate authenticator
2. step. if the 1st step fails authenticate by username/password.

var onLoginRequest = function(context) {
    executeStep(1, {
        onFail: function (context) { 
                   executeStep(2);
        }
    }); 
};

When a user doesn’t have personal TLS certificate then one’s being redirected to Login page. And that page shows an error message about failed login attempt. Which is confusing for most of the users who supposed to authenticate by only username/password pair.

Is it possible to:

• either suppress this error message;
• or pass some option to indicate that executeStep(1) is optional?

Are there any other means to implement this scenario?