Repository navigation
Respect GDPR for broker users #30193
Replies: 4 comments 4 replies
|
Would it be possible to leverage transient users feature (#26637) to achieve GDPR compliance? Keycloak does not store any data about a transient user in its database, the user data are discarded when the user is logged out (together with deletion of the user session). |
No. |
|
During Keycloak-DevDay Pre-Conf Event, we have discussed with some participants and it was common sense that Keycloak must support asking federated users to accept We need to decide the way, Keycloak will be able to ask for
Keycloak team and Keycloak users what do you believe is the best way to proceed with being possible to accept before user is saved for federated users? @thomasdarimont @edwint88 |
|
I'd be able to make a PR if that's the way forward, but I'd probably need guidance on the reject part of the solution, since there are authentication flows that my solution is incompatible with, due to some variables not being available (from what I can tell). |
|
For me, rejecting is meaning user will not created in database and flow will be finished. |
|
Ability to ask user to fill terms and conditions before creating the user would be a good thing; I don't think accepting terms and conditions should be an authentication flow thing, and rather just a general action. One challenge is that required actions currently can only run after authentication has completed. What I could imagine is if we had some way of running actions on different stages, then that could be used for a general terms and conditions action. If user is present it can store it in the user, if not it can add it to the session, then the action triggers again after the user has authenticated and stores if need. I would also think that there are cases where you would want a user to accept terms and conditions prior to filling in the user information and creating the user. |
If someone could implement the change in required actions (mainly for terms and conditions), this could be a solution. |
|
Since transient users was mentioned here (and I know it's not a solution to this problem) I'll mention that is most likely going to be removed and replaced with #38108 |
Uh oh!
There was an error while loading. Please reload this page.
Keycloak already supports GDPR during new User registration asking for accepting terms and conditions. However, when a new broker user attempts to register/sign in using the first-broker-login flow in Keycloak, personal data such as username, name, or email (if provided by the Identity Provider) is stored before the user explicitly consents to the terms and conditions. This practice violates the GDPR requirements in Europe, which mandate that explicit consent must be obtained from the user before any personal data is collected, stored, or processed.
The relevant clause from the GDPR regarding consent is Article 6, which outlines the lawfulness of processing. Specifically, Article 6(1)(a) states:
Furthermore, Article 7 details the conditions for consent, emphasising that consent must be freely given, specific, informed, and unambiguous.
Additionally, Recital 32 of the GDPR provides further clarification on consent, stating:
These provisions collectively underscore the requirement for obtaining explicit consent before collecting or processing personal data.
A github issue has already existed for this. Could you review the important PR we have opened in order to make Keycloak follow European law?
All reactions