Display Identity Providers Sign in button for each organization #52606

seleroy · 2026-09-10T07:58:53Z

seleroy
Sep 10, 2026

Hello,

I am using the latest version of Keycloal, and I have a scenario that I am trying to achieve. Let's say I have:

Most of my users with Keycloak as a source of truth for their credentials + identity
One organization, tied to a domain (test.com) and linked to 2 different OIDC Identity Providers (Okta and EntraID for example)

I would like the behaviour to be the following:

All users land on the same page using the same URL (no hint for example)
On the authentication page, the users only see the username field + the "Sign In" button, they don't see the Identity Providers buttons by default.
When entering their username/email, and clicking Sign In they are redirected:
- if the domain matches test.com, they land on a page where they can see the 2 IDP buttons and can chose which one they want to use
- if the domain does not match, they land on the usual username/password page and still do not see the 2 IDP buttons.

I played with the settings, especially the ones to display the IDP on the login page (both in the IDP settings and in the organizations settings) and the only behaviours I can get are:

If I activate the IDP buttons on the login page only for the organization, they don't display at all
If I activate the IDP buttons on the login at the organization level + at the general IDP settings level, they appear for everyone, on the first page that everybody reaches.

I can't figure out how to display these buttons only after Keycloak matched the domain and identified the correct organization. At this point I can only redirect automatically to a given IDP, but not display a button that will be available only for this organization.

Am I missing something or is it the expected behaviour ?
Thank you

Answered by barry166

Sep 12, 2026

This is supported by the Organizations identity-first login flow, but the settings must be combined in a specific way. For the organization linked to test.com:

Enable Organizations and use the organization-aware Browser flow (it asks for the username/email first).
Link both Okta and Entra ID to that organization.
Set each organization domain to test.com (or the appropriate verified domain).
Enable Hide on login page when organization not resolved for those linked providers. This keeps them off the initial page before an email is known.
Leave Redirect when email domain matches disabled if you want the user to choose between the two buttons. If it is enabled, Keycloak will automatically re…

View full answer

barry166 · 2026-09-12T07:00:24Z

barry166
Sep 12, 2026

This is supported by the Organizations identity-first login flow, but the settings must be combined in a specific way. For the organization linked to test.com:

Enable Organizations and use the organization-aware Browser flow (it asks for the username/email first).
Link both Okta and Entra ID to that organization.
Set each organization domain to test.com (or the appropriate verified domain).
Enable Hide on login page when organization not resolved for those linked providers. This keeps them off the initial page before an email is known.
Leave Redirect when email domain matches disabled if you want the user to choose between the two buttons. If it is enabled, Keycloak will automatically redirect to the matching provider instead of showing both choices.
Ensure the providers are not globally hidden/link-only; the organization-level hide setting is the one that controls visibility before resolution.

The expected flow is therefore: everyone sees the email field first; after user@test.com is submitted, Keycloak resolves the organization and renders the linked IdP buttons. A non-test.com address continues through the normal username/password path. The current Server Administration Guide documents identity-first login, domain matching, Hide on login page when organization not resolved, and Redirect when email domain matches. If you still see no buttons after the domain is resolved, inspect the browser flow binding and the linked-provider settings on the organization rather than the realm-level IdP buttons.

1 reply

seleroy Sep 16, 2026
Author

Thank you very much!
I was missing the good combination between " Hide on login page when organization not resolved" and the "Hide on login page"

Navigation Menu

Repository navigation

Display Identity Providers Sign in button for each organization #52606

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Display Identity Providers Sign in button for each organization #52606

Uh oh!

seleroy Sep 10, 2026

Replies: 1 comment · 1 reply

Uh oh!

barry166 Sep 12, 2026

Uh oh!

seleroy Sep 16, 2026 Author

seleroy
Sep 10, 2026

Replies: 1 comment 1 reply

barry166
Sep 12, 2026

seleroy Sep 16, 2026
Author