Although each realm can have variations in what information we collect., or what authentication process is setup, there is a minimum set of recommendations that should be follow in each realm setup.
...
Field | Mandatory | Type | |
|---|---|---|---|
| 1 | First name | Mandatory | Native to keycloak |
| 2 | Surname | Mandatory | Native to keycloak |
| 3 | Username | Mandatory | Native to keycloak |
| 4 | Email address | Mandatory | Native to keycloak. |
| 5 | Phone number | Recommended as mandatory | +CCC NNNNNNN |
| 6 | WhatsAppID | Optional | +CCC NNNNNNN |
| 7 | Preferred Language | Mandatory | additional field |
| 8 | User profiling | Optional | additional field |
| 9 | Type of worker | Optional | additional field SHOULD IDEALLY BE BASED ON AN STANDARD CLASSIFICATION |
| 10 | Employee ID | Optional | additional field |
| 11 | Health Unit | Optional | additional field |
| 12 | City/Town | Optional | additional field |
| 13 | SubNational L2 | Optional | additional field |
| 14 | SubNational L1 | Optional | additional field |
Information not collected:
...
First Name + “.” + Last Name (rodolfo.melia)
Initial First Name + “.” + Last Name (r.melia)
Initial First Name + Last Name (rmelia)
Username verification
Customization of message By Realm if username is not available - possible, part of the Realm Theme
Expected for all users. Keycloak will enforce uniqueness within the Realm.
For self-created accounts, users will receive an email that they need to open an visit the suggested URL for email validation.
For manually created account or imported accounts, email can be set to ‘verified’
...
Password recovery
always enabled (email recovery)
2FA
| Status | ||||
|---|---|---|---|---|
|
...
Token validity
| Status | ||
|---|---|---|
|
Session values
- Online - 48 hrs
- Offline - 7 days
Account lockout
| Status | ||||
|---|---|---|---|---|
|
after 3 attempts
Wait increments of 1m, up to 15m
auto-reset: 12 hrs.
Account Expiration Date
| Status | ||
|---|---|---|
|
...
|
If required, an account can be schedule to expire on a given date. This is used for consultants on short term contracts.
Possible workaround:
Custom field with desired expiration date
A custom script could disable accounts passed the expiration date