Keycloak - require user to set password after email verification

user_7826958 0
Viewed 5013

We are evaluating KeyCloak to replace our custom implementation for user registration and authentication.

Our current workflow provides a registration screen where users can self-register. On submitting the registration form, a custom validation flow is triggered, following which an email is sent to the user to verify their email and activate their account. The link in the email allows them to set a password and then sends them a welcome email.

I am using the Admin REST client API to implement this workflow. I have gotten as far as the email verification part.

My questions:

  1. After the user has verified their email, is there a way I can direct KeyCloak to show them a Set Password screen?
  2. Authentication flows - If I am writing this custom workflow, does the authentication flow for registration set up via the admin console still apply?
keycloak
2 Answers

Set temporary= true in the credentials object (auth/admin/realms/yourrealm/users) when calling the user creation API. Sample JSON body mentioned below. Then user will be redirected to Keycloak in the initial login to change the password.

  {
    "createdTimestamp": 1587754061774,
    "username": "John",
    "enabled": true,
    "firstName": "John",
    "totp": false,
    "emailVerified": true,
    "disableableCredentialTypes": [],
    "requiredActions": [],
    "notBefore": 0,
    "groups": [],
    "credentials": [{
        "type":"password",
        "value":"1qaz@WSX",
        "temporary":true
    }],
    "access": {
        "manageGroupMembership": true,
        "view": true,
        "mapRoles": true,
        "impersonate": true,
        "manage": true
    }
}
user_127740550

Thank you CodeWalter.. For anyone else who might need it, this is how I did it using a Java client.

        Keycloak keycloak = KeycloakBuilder.builder() 
                .serverUrl(SERVER_URL) 
                .realm(MASTER_REALM) 
                .grantType(OAuth2Constants.CLIENT_CREDENTIALS)
                .clientId(CLIENT_ID) 
                .clientSecret(CLIENT_SECRET) 
                .build();       
        
        // Define user
        UserRepresentation user = new UserRepresentation();
        user.setEnabled(true);
        user.setUsername("first.last@gmail.com");
        user.setFirstName("First");
        user.setLastName("Last");
        user.setEmail("first.last@gmail.com");
        user.setAttributes(Collections.singletonMap("MRN", Arrays.asList("11111")));
        
        // Define password credential
        CredentialRepresentation passwordCred = new CredentialRepresentation();
        passwordCred.setTemporary(true);
        passwordCred.setType(CredentialRepresentation.PASSWORD);
        passwordCred.setValue("Password@1");
        
        user.setCredentials(Arrays.asList(passwordCred));
        
        // Get realm
        RealmResource realmResource = keycloak.realm(PHUB_REALM);
        UsersResource usersRessource = realmResource.users();

        // Create user (requires manage-users role)
        Response response = usersRessource.create(user);
        String userId = CreatedResponseUtil.getCreatedId(response);
        System.out.println("Response: " + response.getStatusInfo());
        System.out.println(userId);
        
        UserResource u = realmResource.users().get(userId);
        u.sendVerifyEmail();
user_78269580
Related