Hi,
We would like to add a legitimation query after the login. In detail, users with a specific role shall first see a screen/pop-up which contains basically a download link to some documents and a confirm field. Only if the user confirms that she has read and understood the documents attached, the log in will proceed and the user can use the application. If the user refuses, she will be logged out.
This legitimation query must open/pop up for users with a specific role always (it should not be saved in the user management). Users holding other roles shall be able to log in as usual without a need to confirm something.
We had different options in mind, e.g., having a role-specific welcome page. Alternatively, we thought of showing a pop-up which disables the access to the UI as is done, e.g., when the user needs to confirm that changes are lost when proceeding without saving the changes. For this latter option, however, we would still need the possibility to log-out. Either way, this legitimation query is to be shown before even showing the overview model.
What would be the best practice to model such a legitimation query?
Authentication solutions such as keycloak can require the user to accept terms and conditions when registering - see Keycloak Requiring user to agree to terms and conditions during registration. It might be possible to configure keycloak to require this with first login because that is an action in the keycloak terms that can be configured. Other authentication providers might provide similiar mechanisms.
The terms and conditions can be modeled via a cms page that is accessible without auth so that keycloak can contain a link to this page.
This way your application is free of handling this part of the authorization..
@andreas-fresh-mesa Thanks a lot for your valuable comment!
Indeed, the required action upon login sounds very promising. Still, I have two concerns left:
- The Server administration guide states: “After the first login, these actions are no longer required. You add required actions on the Details tab of that user.” and also “You can enable a required action that new users must accept the terms and conditions before logging in to Keycloak for the first time.”
In our use case, however, the confirmation is required at every login - not only the first login.
- I can see the options to configure the required action for specific users or for all users. However, we would like to configure it for any user with a specific role.
I don’t really know that much about keycloak. So you probably have to figure out a lot of stuff yourself. However regarding the requirement that the user needs to aggree to T&C on every login this sounds more to me like you need to add another page to the login workflow or to add another checkbox to the login page with a link to the T&C. Not sure how one can represent that in keycloak.
Thanks a lot for your comments!
As adapting the Keycloak configurations seems to come with a lot of support overhead for our specific application, we are also discussing an alternative solution on the modeling side: Show pop-up after login before entering overview page