Keycloak - require email verification before creating the user

Question

We are evaluating Keycloak to replace Forgerock for user registration

Our current workflow provides a registration screen. On submitting the registration form, an email is sent to the user to verify their email and activate their account. The link in the email confirms the user registration before creating the user in forgerock.

My questions:

Is there a way to create the user after the email verification as a confirmation? I have this implementation but sendVerifyEmail it is just for checking the email and basically the user can login even if he/she didn't check the email

Keycloak keycloak = KeycloakBuilder
                    .builder()
                    .serverUrl(KEYCLOAK_URL)
                    .realm(KEYCLOAK_REALM)
                    .username(KEYCLOAK_USER)
                    .password(KEYCLOAK_PASSWORD)
                    .clientId(KEYCLOAK_ADMIN_CLI)
                    .build();

            CredentialRepresentation credential = createPasswordCredentials(userRegistrationRequest.getPassword());
            UserRepresentation user = new UserRepresentation();
            user.setEmail(userRegistrationRequest.getEmail());
            user.setCredentials(Collections.singletonList(credential));
            user.setEnabled(true);

            // Get realm
            RealmResource realmResource = keycloak.realm(KEYCLOAK_REALM);
            UsersResource usersResource = realmResource.users();

            // Create user (requires manage-users role)
            Response response = usersResource.create(user);
            String userId = CreatedResponseUtil.getCreatedId(response);
            System.out.println("Response: " + response.getStatusInfo());
            System.out.println(userId);

            UserResource u = realmResource.users().get(userId);
            u.sendVerifyEmail();

Answer 1

This is late though but you can set the user representation email verified to false when creating the user. So they won't be able to access until they verify the email.