Allow members joining multiple organizations #29613

pedroigor · 2024-05-16T13:39:35Z

Removes the constraints we have today to allow users to join multiple organizations
Most of the changes are related to changing methods and places to support users/members associated with multiple organizations
A member of different organizations is a managed member in only one of the organizations. By that, we ensure members always have a single source of truth for their identities. This PR depends on Make sure users created through a registration link are managed members #30743 and should be updated accordingly.
The OrganizationAuthenticator was refactored to make it simpler and to support members of multiple organizations
Removing kc.org user attribute
Introducing cache to some query methods that were previously relying on the kc.org user attribute

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2024-06-06T22:11:37Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUserConcurrent

Keycloak CI - Store Model Tests

java.util.ConcurrentModificationException: java.util.ConcurrentModificationException
	at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486)
	at java.base/java.util.concurrent.ForkJoinTask.getThrowableException(ForkJoinTask.java:540)
...

Report flaky test

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUserConcurrent

Keycloak CI - Store Model Tests

java.util.ConcurrentModificationException: java.util.ConcurrentModificationException
	at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486)
	at java.base/java.util.concurrent.ForkJoinTask.getThrowableException(ForkJoinTask.java:540)
...

Report flaky test

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUserConcurrent

Keycloak CI - Store Model Tests

java.util.ConcurrentModificationException: java.util.ConcurrentModificationException
	at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486)
	at java.base/java.util.concurrent.ForkJoinTask.getThrowableException(ForkJoinTask.java:540)
...

Report flaky test

ahus1

Approving based on @sguilhen's approval. Not merging yet in case a review from another person is necessary.

ahus1 · 2024-07-23T14:10:51Z

BTW, Adapter IT failed, rerunning that job.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2024-07-24T00:22:05Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.LoginHotpTest#loginWithHotpSuccess

Keycloak CI - Forms IT (chrome)

java.lang.IllegalStateException: Could not start mail server smtp:localhost:3025, try to set server startup timeout > 2000 via ServerSetup.setServerStartupTimeout(timeoutInMs) or -Dgreenmail.startup.timeout
	at com.icegreen.greenmail.util.GreenMail.start(GreenMail.java:118)
	at org.keycloak.testsuite.util.GreenMailRule.before(GreenMailRule.java:54)
	at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:50)
	at org.jboss.arquillian.junit.Arquillian$7$1.invoke(Arquillian.java:273)
...

Report flaky test

org.keycloak.testsuite.forms.LoginHotpTest#loginWithHotpFailure

Keycloak CI - Forms IT (chrome)

java.lang.IllegalStateException: Could not start mail server smtp:localhost:3025, try to set server startup timeout > 2000 via ServerSetup.setServerStartupTimeout(timeoutInMs) or -Dgreenmail.startup.timeout
	at com.icegreen.greenmail.util.GreenMail.start(GreenMail.java:118)
	at org.keycloak.testsuite.util.GreenMailRule.before(GreenMailRule.java:54)
	at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:50)
	at org.jboss.arquillian.junit.Arquillian$7$1.invoke(Arquillian.java:273)
...

Report flaky test

org.keycloak.testsuite.forms.LoginHotpTest#loginWithHotpInvalidPassword

Keycloak CI - Forms IT (chrome)

java.lang.IllegalStateException: Could not start mail server smtp:localhost:3025, try to set server startup timeout > 2000 via ServerSetup.setServerStartupTimeout(timeoutInMs) or -Dgreenmail.startup.timeout
	at com.icegreen.greenmail.util.GreenMail.start(GreenMail.java:118)
	at org.keycloak.testsuite.util.GreenMailRule.before(GreenMailRule.java:54)
	at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:50)
	at org.jboss.arquillian.junit.Arquillian$7$1.invoke(Arquillian.java:273)
...

Report flaky test

org.keycloak.testsuite.forms.LoginHotpTest#loginWithMissingHotp

Keycloak CI - Forms IT (chrome)

java.lang.IllegalStateException: Could not start mail server smtp:localhost:3025, try to set server startup timeout > 2000 via ServerSetup.setServerStartupTimeout(timeoutInMs) or -Dgreenmail.startup.timeout
	at com.icegreen.greenmail.util.GreenMail.start(GreenMail.java:118)
	at org.keycloak.testsuite.util.GreenMailRule.before(GreenMailRule.java:54)
	at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:50)
	at org.jboss.arquillian.junit.Arquillian$7$1.invoke(Arquillian.java:273)
...

Report flaky test

vramik

Thank you @pedroigor for the PR, I have only few suggestions about naming and one question about caching. I assume there will be needed rebase after #31471 would be merged.

vramik · 2024-07-19T12:30:26Z

...client-jee/src/main/java/org/keycloak/admin/client/resource/OrganizationMembersResource.java

    @GET
    @Produces(MediaType.APPLICATION_JSON)
-    OrganizationRepresentation getOrganization(@PathParam("id") String id);
+    List<OrganizationRepresentation> getOrganization(@PathParam("id") String id);


Suggested change

List<OrganizationRepresentation> getOrganization(@PathParam("id") String id);

List<OrganizationRepresentation> getOrganizations(@PathParam("id") String id);

@vramik Just realized ... Do we really need this method? Why not just have member(id).getOrganizations?

Probably not, good catch.

vramik · 2024-07-24T09:10:05Z

...-client-jee/src/main/java/org/keycloak/admin/client/resource/OrganizationMemberResource.java

    @DELETE
    Response delete();
+
+    @Path("organization")


Suggested change

@Path("organization")

@Path("organizations")

vramik · 2024-07-24T09:11:51Z

...client-jee/src/main/java/org/keycloak/admin/client/resource/OrganizationMembersResource.java

            @QueryParam("max") Integer max
    );

    @Path("{id}/organization")


Suggested change

@Path("{id}/organization")

@Path("{id}/organizations")

vramik · 2024-07-24T09:45:26Z

...n/java/org/keycloak/models/cache/infinispan/organization/InfinispanOrganizationProvider.java

+        UserModel member = getMemberById(organization, user.getId());
+
+        if (member == null) {
+            return false;
+        }


Can we rely on CachedMembership instead of getting the member by id? I am probably missing something ... if CachedMembership is not invalidated then we may be able to get the information whether the users is Managed or not from it, don't we?

If the getMemberById returns null is because the user is not a member.

I see, thanks, so it means that user might not a member, but could still be cached the information within CachedMembership, right?

pedroigor · 2024-07-24T13:42:07Z

@vramik Applied your suggestions.

pedroigor · 2024-07-24T13:43:02Z

@vramik It is rebased already. I'll check now the behavior with your latest changes.

Closes keycloak#30747 Signed-off-by: Pedro Igor <[email protected]>

Signed-off-by: Pedro Igor <[email protected]>

mhajas

Approving based on reviews from @keycloak/core-iam

jaeaxt · 2024-09-23T16:05:11Z

Today I tried Keycloak 25.0.6 but when I try to add user to a second Organization gave a error than the user only can have 1 Organization, is that ok ?

sschu · 2024-09-23T16:11:32Z

@jaeaxt This was merged into main so will be available in the next major release of Keycloak which is Keycloak 26.

DGuhr · 2024-09-25T09:37:30Z

Hey Folks 👋 Great work with orgs so-far. I've just tried out the latest nightly build via

docker run --name kc-orgs -d -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -p 8080:8080 quay.io/keycloak/keycloak:nightly start-dev --features organization

, created 2 orgs foo/foo.com and bar/bar.com, and added a user baz/[email protected] as member in both orgs.

Now I wanted to login using the new identity first - flow and just "baz".

My expectation was that I could somehow "choose" for which org I want to log in.
Instead, the bar.com password/IdP page was shown.

Now I am a bit unsure how, with this PR, it'd be possible to login my [email protected] user under the context of the foo org. It'd be awesome if you had any hints, couldn't find an issue so-far and thought I'd ask here first :)

sguilhen · 2024-09-25T12:38:16Z

@DGuhr I just tested here and I see what you mean - if the user has an e-mail that matches one of the orgs, we're being a bit too opinionated towards the IDP selection. In this case, we're narrowing the IDP choices based on the e-mail that matched.

@pedroigor we need to discuss how to make this a little less opinionated - if user belongs to more than 1 org, then if none of the orgs has an idp that automatically redirects based on e-mail, we prob should be assembling the IDP list in a way that all orgs the user belongs too are represented (provided they have public IDPs, that is).

sguilhen · 2024-09-25T12:40:06Z

If you think about it, even with no public IDPs, if the user is a member of multiple orgs then perhaps a better option would be not to select the IDP itself, but the org he wants to sign in to. Then we redirect to the org IDP, which doesn't even have to be public.

Anderen2 · 2025-08-05T16:30:47Z

If you think about it, even with no public IDPs, if the user is a member of multiple orgs then perhaps a better option would be not to select the IDP itself, but the org he wants to sign in to. Then we redirect to the org IDP, which doesn't even have to be public.

Hi @sguilhen and @pedroigor.
Sorry for commenting on this closed PR, however I was not able to find any issue or documentation around this. Is this already implemented, or is there a separate issue somewhere on allowing a user to select a org if member of multiple?

Would this also set which organization the user is "primarily acting on behalf of"? Eg. if you have a consultant or similar working on the behalf of multiple of your clients (but always only on one at a time)?

pedroigor · 2025-08-07T14:39:48Z

Hey @Anderen2, no problem. Sometimes I find myself doing the same ... Not ideal because comments usually get lost.

There is support for allowing users to select an organization when they are a member of multiple ones. The part of the documentation covering this capability is here [1].

Basically, whenever you send the organization scope, if the user has multiple organizations, he will be prompted to select one. After doing so, the authentication will happen in the context of that organization so that any IdP associated with the organization is considered (including automatic redirect), and the token will have the organization claim mapping to the selected organization.

Is this what you are looking for?

[1] https://www.keycloak.org/docs/latest/server_admin/#_mapping_organization_claims_

keycloak-github-bot bot added the flaky-test label May 16, 2024

This was referenced May 16, 2024

Flaky test: org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithCRLSignedWithIntermediateCA3FromTruststore #25204

Closed

Flaky test: org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromFile #25674

Closed

This was referenced Jun 5, 2024

Keycloak Organizations #30180

Open

Keycloak Organizations as a supported feature #30229

Closed

pedroigor force-pushed the org-members-multiple-orgs branch from fef8950 to 1379d88 Compare June 6, 2024 21:16

This was referenced Jun 6, 2024

Flaky test: org.keycloak.testsuite.oauth.TokenIntrospectionTest#testUnsupportedToken #30111

Closed

Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled #30188

Closed

keycloak-github-bot bot reviewed Jun 6, 2024

View reviewed changes

pedroigor force-pushed the org-members-multiple-orgs branch from 1379d88 to 4bb0fdb Compare June 12, 2024 13:13

This was referenced Jun 12, 2024

Flaky test: org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUsersInTheSameGroupConcurrent #30264

Closed

Flaky test: org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUserConcurrent #30236

Closed

pedroigor mentioned this pull request Jun 25, 2024

Support for members joining multiple organizations #30747

Closed

pedroigor force-pushed the org-members-multiple-orgs branch 4 times, most recently from 7d9d70d to 95cc95a Compare July 10, 2024 12:57

keycloak-github-bot bot mentioned this pull request Jul 10, 2024

Flaky test: org.keycloak.testsuite.oidc.AuthenticationMethodReferenceTest#testAmrPastMaxAge #26117

Closed

pedroigor force-pushed the org-members-multiple-orgs branch 6 times, most recently from cc92c0d to 16d784f Compare July 16, 2024 19:48

pedroigor changed the title ~~wip: support for joining multiple organizations~~ Allow members joining multiple organizations Jul 16, 2024

pedroigor changed the title ~~Allow members joining multiple organizations~~ Allow members joining multiple organizations Jul 16, 2024

pedroigor marked this pull request as ready for review July 16, 2024 19:49

pedroigor requested review from a team as code owners July 16, 2024 19:49

xianli123 mentioned this pull request Jul 23, 2024

[UX Design] Show user's organization info in the Admin and Account UIs #31507

Closed

sguilhen approved these changes Jul 23, 2024

View reviewed changes

ahus1 previously approved these changes Jul 23, 2024

View reviewed changes

pedroigor force-pushed the org-members-multiple-orgs branch from 4fdab18 to 0061b02 Compare July 23, 2024 23:38

keycloak-github-bot bot mentioned this pull request Jul 24, 2024

Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently #31091

Closed

keycloak-github-bot bot reviewed Jul 24, 2024

View reviewed changes

vramik reviewed Jul 24, 2024

View reviewed changes

pedroigor force-pushed the org-members-multiple-orgs branch from 0061b02 to 770cbe7 Compare July 24, 2024 11:52

pedroigor dismissed ahus1’s stale review via 24905da July 24, 2024 13:40

pedroigor force-pushed the org-members-multiple-orgs branch from 770cbe7 to 24905da Compare July 24, 2024 13:40

vramik approved these changes Jul 24, 2024

View reviewed changes

pedroigor force-pushed the org-members-multiple-orgs branch 2 times, most recently from 9e597b3 to 9bb1987 Compare July 26, 2024 12:53

pedroigor added 2 commits July 26, 2024 11:20

Allow members joining multiple organizations

a42c201

Closes keycloak#30747 Signed-off-by: Pedro Igor <[email protected]>

Invalidating domain cache and introducing cache for more query methods

116d685

Signed-off-by: Pedro Igor <[email protected]>

pedroigor force-pushed the org-members-multiple-orgs branch from 9bb1987 to 116d685 Compare July 26, 2024 14:20

sguilhen approved these changes Jul 26, 2024

View reviewed changes

mhajas approved these changes Jul 29, 2024

View reviewed changes

mhajas merged commit 04bd665 into keycloak:main Jul 29, 2024

	List<OrganizationRepresentation> getOrganization(@PathParam("id") String id);
	List<OrganizationRepresentation> getOrganizations(@PathParam("id") String id);

Allow members joining multiple organizations #29613

Allow members joining multiple organizations #29613

Uh oh!

Conversation

pedroigor commented May 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

keycloak-github-bot bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot bot commented Jun 6, 2024

Unreported flaky test detected

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUserConcurrent

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUserConcurrent

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUserConcurrent

Uh oh!

ahus1 left a comment

Choose a reason for hiding this comment

Uh oh!

ahus1 commented Jul 23, 2024

Uh oh!

keycloak-github-bot bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot bot commented Jul 24, 2024

Unreported flaky test detected

org.keycloak.testsuite.forms.LoginHotpTest#loginWithHotpSuccess

org.keycloak.testsuite.forms.LoginHotpTest#loginWithHotpFailure

org.keycloak.testsuite.forms.LoginHotpTest#loginWithHotpInvalidPassword

org.keycloak.testsuite.forms.LoginHotpTest#loginWithMissingHotp

Uh oh!

vramik left a comment

Choose a reason for hiding this comment

Uh oh!

vramik Jul 19, 2024

Choose a reason for hiding this comment

Uh oh!

pedroigor Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

vramik Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

vramik Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

vramik Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

vramik Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

pedroigor Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

vramik Jul 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pedroigor commented Jul 24, 2024

Uh oh!

pedroigor commented Jul 24, 2024

Uh oh!

mhajas left a comment

Choose a reason for hiding this comment

Uh oh!

jaeaxt commented Sep 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sschu commented Sep 23, 2024

Uh oh!

DGuhr commented Sep 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sguilhen commented Sep 25, 2024

Uh oh!

sguilhen commented Sep 25, 2024

Uh oh!

Anderen2 commented Aug 5, 2025

Uh oh!

pedroigor commented May 16, 2024 •

edited

Loading

vramik Jul 24, 2024 •

edited

Loading

jaeaxt commented Sep 23, 2024 •

edited

Loading

DGuhr commented Sep 25, 2024 •

edited

Loading