Prevent ADFS users login if they are not registered

Help
,
2

I have finally found a way to do this.

Just a note though, I am not using the Authorization Code grant and I don’t know how this might interact with it.

Here are the basic steps:

  1. Setup your ADFS/Enterprise connection, AS WELL AS a regular Username-Password connection
  2. Create a rule based on the Link Users Example Rule
    This will automatically link the ADFS profile when the user first logs in
    NOTE: there’s a bit of weirdness if you have rules after this one. What seems to work is returning originalUser in the callback instead of user.
  3. (Optional) At this point, users could theoretically login using both their Username-Password combination, as well as their ADFS account. To prevent this, add a rule that looks for an arbitrary flag in the user’s app_metadata which would specify if password login is disabled

Then to add users:

  1. Use the Management API to create your desired users. Use the Username-Password connection for this.
    Set verify_email: false and email_verified: true
    At this point, you can also configure app_metadata, authorization etc…
  2. Tell the user to login. If you are using the Hosted Login page, they should get the SSO option once they enter their email address.

And that’s it! A bit of a mission, and maybe a bit hacky, but its the only way I could get this working.

1 Like