3

I am trying to create a new user and then verify his email address using REST API. To send verification email I am using my own email class in Springboot, so I am not calling keycloak's /send-verify-email endpoint! After I create user, I can see in keycloak console that user is created, enabled and his email address needs to be verified.

But here lies the problem. How can I verify the email using Keycloak REST API? There is no endpoint for this purpose and I can't update UserRepresentation, because I have no Access Token. And without access token, you can't update User, right?

So there should be some unsecured endpoint that won't require Access token and verify email like <userID>/verify-email or so, but there isn't. So I am looking for alternatives, how to verify user's email.

When using Keycloak Springboot client (or how it is called), there are methods for this purpose (like update user without token), but unfortunately I am not able to use this library.

I am really starting to hate keycloak..

Thank you all for your help

Kuba Šimonovský
  • 2,013
  • 2
  • 17
  • 35

1 Answers1

8

So there should be some unsecured endpoint that won't require Access token and verify email like /verify-email

That is really insecure approach - anyone will be able to verify any email.

Create new admin user/client with proper permission configuration (it needs to be allowed to update users) and use it (= you need login procedure -> access token) to update user model (PUT /{realm}/users/{id} - emailVerified: true). Of course this admin user will own responsibility that email is correct.

Jan Garaj
  • 25,598
  • 3
  • 38
  • 59
  • Okay, this is a good answer. Do you know exactly the permission that I should add to this account? Is it from Realm management - manage users? – Kuba Šimonovský May 26 '20 at 06:53
  • I have facing to the same scenario. Can we use a client with "manage-users" realm permission, which means we have to keep that client credentials at the front end right? – Yachitha Sandaruwan Sep 02 '21 at 06:24
  • This solution is working unless there are additional user attributes set. In my case, this didn't work until I added clean-up of the requiredActions field. (I don't know whether this field is our company's addition or keycloak shipped with it) – Alexander Petrovskiy Oct 11 '22 at 11:30