Depending on the policy defined, a user may need to be added to a group in Keycloak. This is true e.g. for GroupOffice.
Depending on the policy at the service connected to fairlogin, you may need to activate the user within the service as an admin of that service after the user has logged in the first time. This is true e.g. for GroupOffice.