Conditional login with OpenId Connect

1
votes

I've been reading about openid connect and doing some experiments with Keycloak.

My question is: Is it possible to add conditional login to an OpenId Connect server?

This is what I'm trying to do. I'm using Keycloak as an identity provider. Clients allow their users to login through my app. But I don't want anyone to access those clients; only those who have paid a subscription can access a client. If a user tries to log in, but he or she hasn't paid a subscription, Keycloak should redirect to a page where the user can buy a subscription plan.

If this is not possible with OpenId Connect, is there a way to do it with Keycloak?

Thank you

1
oauthkeycloakopenid-connect
That's possible by Keycloak. Keycloak provides a flexible way to add required action or own authenticator to login steps. - Muhammed Yalçın Kuru
Thank you @MuhammedYalçınKuru, I think that's what I need. - Miguel Jiménez

1 Answers

1
votes

There are 2 concerns here and it is a general pattern rather than being specific to Keycloak:

  • Authenticate the user
  • Whether user is authorised to use the app

The most standard approach is to use 2 sources of user data:

  • Look up the user from the access token in your own data after login
  • See if they have paid
  • Redirect to the subscription plan page if not

My blog post on User Data Management may give you some ideas.

POSSIBLE IMPLEMENTATION

After login, the UI can call an API endpoint to get claims for the user in the access token:

  • GET /api/userclaims/current

The response can contain an object with fields (claims) from multiple data sources - not just the token. Here is a sample claims object of mine.

A useful technique can be to do the claims collection when your API first receives an access token, then cache results for subsequent API calls withe the same token: