User Actions

User accounts can be in one of 3 states: enabled, disabled and actions required. Accounts that are disabled can only be enabled by an admin. Accounts that have required actions are enabled by the user through successfully completing the required actions.

Accounts that are disabled do not allow users to login to applications, nor is login to the application management pages allowed.

Accounts with required actions do not allow users to login to applications, but limited access to the application management pages is provided. Only functionality required to perform the required actions is provided on the application management pages. For example a user that is required to update the user profile (but not to configure TOTP) is not able to access the TOTP management page, but is able to view/modify the user profile.

A user may have several actions required prior to enabling the account. For example a user may be required to verify the email address and configure TOTP.

When a user logs in or registers via an application and the account has required actions associated with it the user is redirected to the relevant account management page. Once the required actions are completed the account is enabled and the user should be redirected back to the application.

Verify email

A user is required to verify the email address if:

• Registering with a realm that requires users to verify their email address
• A user has previously registered with a realm that did not require a verified email address at the time, but has later changed this option

After registration (or first login after realm requirements have changed) an email is sent to the user. The user is redirected to a page that displays the email address used, and a link to resend the verification email. The user can change the email address if wanted, and can also click a link to resend the verification email. There's also a field to insert the code sent in the email.

The email contains a link that the user should click to verify the email address. The email also contains a code that can be manually copied/pasted into the previously mentioned page.

The link in the email should contain all required query parameters to login the user and redirect the user to the application (client_id, redirect_uri, etc.).

Update profile

A user is required to update the profile if:

• An admin created the account on behalf of the user and wants the user to review/update the profile on first login
• The user logs in with social login and the realm requires users to review the user profile on first social login
• The required details in a user profile for a realm is changed after a user has registered

Reset password

A user is required to reset the password if:

• An admin created an account on behalf of the user and set a tempoary password on it
• The user has clicked the reset password link
• An admin has manually initiated a password reset
• The password has expired

If a user clicks the reset password link and the account has a verified email address an email is sent with the temporary password. Otherwise the temporary password has to be communicated manually to the user by an administrator. In the future we may support sending temporary password using SMS and automated phone calls.

Configure TOTP

A user is required to configure TOTP if:

• Registering with a realm that requires users to use TOTP
• A user has previously registered with a realm that did not require a TOTP at the time, but has later changed this option

Code changes

UserModel

Add:

• UserStatus getStatus()
• void setStatus(UserStatus status)
• List<UserAction> getRequiredActions()
• void addRequiredAction(UserAction requiredAction)
• void removeRequiredAction(UserAction requiredAction)

Remove:

• boolean isEnabled()
• void setEnabled(boolean enabled)

UserStatus (Eenum)

• ENABLED
• DISABLED
• ACTION_REQUIRED

UserAction (enum)

• VERIFY_EMAIL
• UPDATE_PROFILE
• CONFIGURE_TOTP
• RESET_PASSWORD