Review registrations and approve users

Use this procedure for an already-authenticated Keycloak subject requesting SENSE access. SENSE does not create the Keycloak user. There is no dedicated rejection, deactivation, expiry, delete, or reactivate workflow. To withdraw a directly assigned SYSTEM_AUTHORIZED_USER role, use Manage users and roles; inherited or expanded roles cannot be changed directly from this UI.

Prerequisites

• The external Keycloak identity service and the premade realm/client are configured.
• You can sign in to the portal with SYSTEM_ADMIN.
• A realm administrator has validated KEYCLOAK_USER_MANAGER for approvals and attribute changes, and the backing Keycloak service client has full management capability: manage-users and manage-realm.

Validate all three requirements with the realm administrator. SYSTEM_ADMIN is not documented as automatically granting the backend role or Keycloak management capability.

Review and approve a request

1. Open Admin Panels. Only tokens with SYSTEM_ADMIN can open this area; direct non-admin navigation is redirected.
2. Select Roles, then Users. The portal Roles route includes admin?view=roles.
3. Search with Search Users, or sort by Username, Email, First, or Last. Search is client-side and matches username, email, first name, and last name. There is no active registration/approval status filter. The current operator is absent from the list.
4. Select a user. Review the User Classes and Roles shown for that user. User classes are group/class roles. An Unregistered marker means WORKFLOW_ACCESS_REQUESTED is absent. An Unapproved marker means SYSTEM_AUTHORIZED_USER is absent.
5. Select View Registration to review the requester’s read-only values: Email Address, First Name, Last Name, Phone Number, Organization, Title, and Address.
6. Approve the user. Approval adds SYSTEM_AUTHORIZED_USER and creates an approval alert. It does not remove WORKFLOW_ACCESS_REQUESTED.

Expected result

The user can proceed through the normal portal access flow after approval, and an approval alert is created. A first request from a user without SYSTEM_AUTHORIZED_USER adds WORKFLOW_ACCESS_REQUESTED and creates a manager-targeted alert after the user selects Request Approval from “This SENSE deployment requires approval to access.” The button then reads Approval Requested. A retry after that role already exists does not create another alert.

There is no documented create-user workflow. Registration is an approval request for an already-authenticated Keycloak subject.

Safe recovery

If a write fails or the portal reports an error, do not infer authority from the UI or retry with broader permissions. Have the realm administrator check KEYCLOAK_USER_MANAGER and the service client’s manage-users and manage-realm capabilities. The Skip Registration action is not documented here because its operator semantics are unverified.