Overview:

Currently, Any user initiating a first time SSO login using an identifier that already exists in the custodian org - causes an auto migration of the account from custodian to the state tenant it can cause erroneous migration to avoid it user's acknowledgment is required.

If the user is found to match an account in the custodian org when the user tries to login via SSO for the first time, the user should be prompted about the existence of the duplicate account and asked whether the account belongs to them.

...

Account auto-merge workflow should be handled in the portal front end and portal backend. An auto migration of the account from custodian to the state tenant it can cause erroneous migration to avoid its user's acknowledgment is required.

Approach :

...

Conclusions after design discussion

1. Send state token along with email/Phone number encrypted in redirectUri while opening keycloack page.
2. Mobile team should append client_id='andriod'.
3. Before calling migrate API portal should perform the following checks
   - Decrypt the encrypted data to get state token, user email 
   - Check if state token is valid using echo API
   - Check if state token is not expired.
   - Verify the access token
   - Check if email Id from encrypted data and the access token is same.
4. Only after all checks in step 3 are passed migrate API can be called. 
5. Once migration is done user will be notified via email from backend.
6. Mobile related changes - 
   User will be logged as a nonstate user after the user enters password or Gmail.
   Mobile needs to detect by reading the query parameter if auto-merge is in progress or not.
   If auto-merge is in progress mobile will call to portal sending encrypted data and access token to migrate the user.
   
   
   

Open questions for the mobile team? 

Draw.io flow chart link to edit - Untitled Diagram (2).drawio

UI Screens

Verify user via email or phone

...