private String buildURI(URI baseURI, UserModel user) {
        return UriBuilder.fromUri(baseURI)
                         .queryParam("username", user.getUsername())
                         .queryParam("userId", user.getId())
                         .queryParam("emailVerified", user.isEmailVerified())
                         .build()
                         .toString();
    }
A user is required to have their account approved (perhaps manually or by an external process).

{@inheritDoc}

@see AccountApprovalOptions options for URI redirect, admin role name, etc.
sso/keycloak/extensions/src/main/java/io/apiman/manager/sso/keycloak/approval/AccountApprovalRequiredActionProvider.java