Accessing resources based on email domain

[bastiW]

Hi

we are currently in the evaluation phase of Keycloak and ory.

We have a web page with data. The data is accessible by the following rules

• public
• own user data for each user
• data for users with an verified email like [email protected] or [email protected]

Is it possible to set permission roles during the registration based on the email domain (@apple.com or @orange.com)?
Which Ory Product can fulfill our needs?

[aeneasr]

Hi @bastiW - the optimal way to solve this problem would be as follows:

1. Configure a post-registration and post-settings web hook
2. The webhook target should be an API endpoint in your app
3. In the webhook target you should authenticate the webhook request (e.g. using a static API key) which you configured in step (1)
4. The webhook target checks the email address and calls Ory's Permission API (Ory Keto) to set up the correct permissions

Hope this helps!