Search code examples
single-sign-onkeycloak

How do we detect if a user has ever visited a particular client

In every realm in Keycloak, there is client which often represent the application the user is about to access which is represented as client_id in the url, such as

${keycloak_root_url}/auth/realms/${realm_name}/protocol/openid-connect/auth?response_type=code&client_id=${client_id}&redirect_uri=${redirect_uri}

How do we detect if a user has ever successfully logged in into a particular client at least once?

Solution

  • Out-of-the-box and depending on the type of use-case and client flow used you could either:

    1. Enable the admin events, in particular the Event Type : LOGIN and then query those events for the clientID and id of the user;
    2. If the client in question is using either Browser Flow or Direct Grant Flow then you can (under the Authentication tab) copy and create your own version of one of the flows accordingly. Then add a sub-flow that forces the user to perform an action only during the first login (e.g., accept the 'Terms and Conditions'). Afterwards, under Authentication Flow Overrides (of the client) override the flow with your customized flow, accordingly. Finally, query the user for the first login action required by the client in question.

    DISCLAIMER: I am not claiming that those are either the best solutions for this use case or that they are bulletproof.