https://www.ory.sh/ logo
Join Slack
Powered by
<@U04BCNGAATT> Hello. good question. can you first...
# talk-kratos
s
@aloof-oxygen-62624 Hello. good question. can you first post you identity schema here? then we can have a discussion about how to achieve your goal.
a
This is still in the planning phase, so I dont have a proper identity schema yet. However, it would contain at least the e-mail as public metadata (not a trait)
s
thats standard anyway.
a
And some kind of private metadata containing the flag, so that such an automatic linkage can only happen once
The standard is an email as a mutable trait
As my app only allows social logins, such data should not be changed by the user
s
I dont really understand why you need webhooks (supported ) when you have a data madel for ids that contains your flags. Lets try to model that first. In general I think you can achieve your goals either way with Kratos
a
I'd need to implement automatic linking. I want an admin to be able to create an account before the user has ever logged in with a social login. This is so that the admin can configure some other data related to the user (such as permissions in other parts of the application) without the requirement of the user having logged in at least once
For example, we would give 10 users from an external company access to our application by creating users for them in our AAD IdP. We'd like to assign them certain permissions in our application, which are linked to Kratos identities, without having to wait before each of them logged in at least once into Kratos with their new AAD account
I hope this is understandable 🙂
s
is AAD = Azure Active Directory
a
Correct
Its configured as a social login in the Kratos instance
j
Have you considered storing the special flags in the AAD IdP instead of in Kratos? They could be added against the users there and requested by Kratos.
a
Thinking more about it, the lack of a social link in a Kratos identity would fulfill the same function as such a flag
As any identity without a linked social AAD account would be one of those "incomplete" users that should be linked against if they log in for the first time
Open in Slack
PreviousNext
Powered by