I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check has been done with several different ways (most of them legacy, unsecure and, tbh, very ugly). We do support username and password authentication but this is by far the less common way used for gaining access to content. For the sake of this post let's assume that the only alternative is for a user to reach our product from a company's internal portal - we call this "Referral access".

We are now trying to leverage existing Identity and Access Management (IAM) solutions (trying Keycloak, at the moment) which works fine for the cases where a User authenticates themselves (possibly using username/password). The problem is that, for legacy reasons, we also need to support that:

  1. an Anonymous user can use "Referral access" to gain access to a piece of content.
  2. a Logged in user can expand their entitlements by using "Referral access" to access that their company paid for.

So my question is: Is it a good idea to have Keycloak issue web sessions for an "anonymous" user?

My idea was to have a known (and anonymous) user in Keycloak that would be used to hold all anonymous user's web sessions. We could then include in each session (anonymous or not) a list with extra company ids that would be populated regardless of the user being logged in or not.

I think that all this is technically possible but it doesn't feel very correct so I was looking for guidance in the right direction...

Anyone has some tips and/or know where I can find more information about this?

  • It's not uncommon to create an unique user id/hash for each anonymous user. A typical use case is to allow them to start customizing content before becoming a member. Then, when they sign up, they still have all their custom content attached to their account. Apr 8, 2019 at 11:57
  • Thanks for the prompt response. I think part of the reason I find that weird is because I can't find a place inside KC to set up such users and using a "normal" user to achieve this goal feels like a workaround...
    – Leandro
    Apr 8, 2019 at 12:29
  • Also you mention creating a new userId/hash per anonymous user but the problem there is that most of these anonymous users have no intention of registering an account with us... That would make us have huge amounts of "garbage" accounts...
    – Leandro
    Apr 8, 2019 at 12:40
  • @Leandro Depending on your resource constraints, you could run an automatic process to clean up anonymous accounts that were created more than x number of days ago. Apr 8, 2019 at 13:17
  • Exactly that. Once the user effectively ends their session, you can just delete their account and session info, since they have no way to access it anymore. If you don't know when they've ended their session, you can wait a "safe" amount of time: i.e. whatever the business deems is reasonable. Apr 8, 2019 at 13:53