User authorisation
If user registration is disabled and an IDP integrated with Keycloak the authentication part is handled by Keycloak/External IDP but if they do not exist in Osie the user is prompted to fill out the registration page.
It would be useful if we could choose to disable this functionality and either redirect to another page or display an error that they are not authorised and to contact the provider.
Log in to comment and vote
Comments3
jamesm
Jun 12
We would like to see this as well - as our customer base will be invited to the platform once it’s ready. We don’t want to see customers joining “self-service” style.
bens
Mar 9
Yes - users would be manually added (created via API during an external provision process) or invited.
It’s not directly related to the company concept but there is some overlap (e.g. users that are associated as part of @domain.com could be allowed as they are part of a company)
The use case is that the IDP is used across many platforms but only a subset of those users will be allowed to use Osie. Just because they have authenticated shouldn’t allow them access to the platform.
Looking at keycloak flows it may be possible to implement it there? (as part of first broker login, disable the step that runs if they do not exist). That might then cause a problem for the company concept though
Marius Leustean
Feb 24
Does this mean Users are provisioned manually by administrators (or by an invitation)?
Does this correlate in any way with the “Company” concept you described earlier, where you would whitelist all users of a @domain.com and forbid anybody else? Could you be more verbose in describing the usecase, maybe?