Multiple organizations in JWT by default #49128

bickelj · 2026-05-19T14:46:13Z

bickelj
May 19, 2026

It seems I can get a single organization in the JWT by default when a user is part of one organization by making sure there is a client scope and mapper set to appear by default. When the user is part of two organizations, the organization(s) disappear from the JWT. The accepted solution seems to be to require each and every client to request organization:* scope (or whatever the name of your client scope is named plus the colon plus the asterisk).

I do not understand why this must be so. For example, before and after the introduction of organizations, other plural attributes were/are available by default in the JWT without a :*, such as:

  "allowed-origins": [
  ],
  "realm_access": {
    "roles": [
    ]
  },
  "resource_access": {
    "account": {
      "roles": [

All of allowed-origins, roles, and roles are a single word in the plural form without requiring clients to request allowed-origin:* or role:*.

Is there a way to get multiple organization by default without requiring all clients to request them in the form organization:* and if not, is there a reason (other than time/effort) this couldn't be supported in a future version of Keycloak?

I reviewed the past tickets listed here but this still seems like a bug to me.

mg1986jp · 2026-05-27T13:07:25Z

mg1986jp
May 27, 2026

I think this is by design, though I agree the UX around it is confusing.

When a user belongs to a single org, Keycloak can unambiguously include it in the token. With multiple orgs, Keycloak doesn't know which org context the client wants, so it probably drops them from the default claims to avoid leaking org membership across clients that shouldn't see it. The organization:* scope is the client's way of saying "I need all orgs for 8000 this user."

The comparison with realm_access.roles isn't quite apples-to-apples — roles are global to the realm and don't have the same multi-tenancy concern. Organizations are specifically designed for multi-tenant isolation, so the default behavior is to be restrictive rather than expose all memberships.

If you want all clients to always get the full org list without requesting the scope explicitly, I believe you can add the organization client scope as a "Default" scope at the realm level (Realm Settings → Client Scopes → Default Client Scopes). That way every client automatically requests it. You still need the mapper in place, but you shouldn't have to modify each client individually.

2 replies

bickelj May 27, 2026
Author

I currently have an organizations client scope set as default, as well as the mapper, the issue is that this does not work to show all the organizations by default. If a client can simply ask for organizations:* or organization:* this does not prevent leaks of organization membership.

col-panic Oct 10, 2026

I find it very difficult to use the scope organization:* first, it is not possible within keycloak itself to set this scope when evaluating a client. Second e.g. is https://oauth2-proxy.github.io/oauth2-proxy/ , when adding an environment value like this
OAUTH2_PROXY_SCOPE="openid organization:*" it will not be accepted. So there is no means for me to use it ATM.

Navigation Menu

Repository navigation

Multiple organizations in JWT by default #49128

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Multiple organizations in JWT by default #49128

Uh oh!

bickelj May 19, 2026

Replies: 1 comment · 2 replies

Uh oh!

Uh oh!

mg1986jp May 27, 2026

Uh oh!

bickelj May 27, 2026 Author

Uh oh!

col-panic Oct 10, 2026

bickelj
May 19, 2026

Replies: 1 comment 2 replies

mg1986jp
May 27, 2026

bickelj May 27, 2026
Author