Repository navigation
|
Hi, I have recently started using the Organizations feature in Keycloak which has been extremely useful in our multi tenant application. My only problem at the moment is that by default it seems only the Organization name is added to the access token. Is there any way to map the Organization Id into the token, or at least an Organization attribute? I have had a look at the Organization Membership Mapper, but it doesn't appear to have any settings to configure what attributes of the Organization are added ( or am I missing something? ) In my scenario I have a separate Tenant Micro Service which stores additional information about the Tenants / Organizations and ideally I would like to be able to share some kind of ID between it and Keycloak in order to match Organizations up. At the moment I have to do this based on the name of the organization ( as that is what is contained in the Access Token ) and that is not ideal as the name is changeable in keycloak and It means that I am forced to use GUIDS for the name. All I really need is the Id of the Organization to be added to the access token. |
Replies: 4 comments 21 replies
|
Hi, |
|
@mzvankovich @magoogli Thanks for the feedback and info about your use cases. I will ask the team to look into the import/export and see if we can make it keep the ids across imports, so that it can be safely included in the token as it is in the PR that was opened. I will hold that PR for the moment, and try to get the import/export sorted first (maybe by the end of the week, let's see) |
|
@sguilhen I have one more concern about the muttable organization id. There are still no events for organization #31421, but it will be defenetly introduced, at least I have one related PR #32358. I'm not sure how events are treated now during import/export, but all events are stored id db and they are based on a resource uuid. Moreover, currently I'm buildyng the distributed system and propageting such an organization event (Organiazation Created) further through a message broker. The organization id plays a significant role as correlation id or message id. |
|
@mzvankovich we've had a discussion and the decision was to fix the org import/export and preserve the ids. It will be inline with other resources in Keycloak and is safer from the perspective that an alias can be assigned to a different org (by removing an existing org and creating a new one with the same alias, for example). I'm also reviewing your PR for the events, my plan is to include it along with the org id changes for Keycloak 26. |
|
Update: with #33495 we can now include the org ids in the claim. I've used @mzvankovich 's original commit, and added a switch to the organization scope mapper to control whether the id is to be included or not (similar to what we do with attributes). Tests were also added along with doc updates. This will be in Keycloak 26. Thanks for discussion and the contributions, @mzvankovich and @magoogli ! |
|
@sguilhen Thank you so much - I'm excited for the Keycloak 26 release! |
|
H, but organization is not included into token. |
|
Hello, specify Claim JSON Type. |
|
If you disable default organization client scope (set to optional instead of deafult) from client that you are using and add organization mapper in your custom client scope, the claim will not be visible. Tested 26.0.8 |
|
I had similar problem, and even after doing all this: https://www.keycloak.org/docs/latest/server_admin/#_mapping_organization_claims_ the token did not show up. |
|
Yes, that assessment is correct @mirwaisx . It was a deliberate decision to change the org flows for new realms only because we felt that automatically changing existing flows, which might have been heavily customized by Keycloak admins, could be undesirable. So we limited the functionality to new realms only. One can still manually setup the conditional organization flows in their existing realms - basically add the same constructs in the same place/order we do for new realms. Once the flows are updated the org authenticator should start working. |
|
@sguilhen can you provide any details how to setup the organisation flow in already existing realms? Maybe export/import them or something easy? |
|
It looks like it's just this and then bind it to clients authentification. |
|
If I assign an organization to a user it shows in the token, however if I assign two organizations to a user, none of them shows up. Is there a way to show all organizations in the token? |
|
You should create new scope organization:*, add to client that you use to authorize user and set as default. |
|
is there a way that we allow 1 specific realm role to access any organization without the membership of that organization? through the following scope |
Update: with #33495 we can now include the org ids in the claim. I've used @mzvankovich 's original commit, and added a switch to the organization scope mapper to control whether the id is to be included or not (similar to what we do with attributes). Tests were also added along with doc updates. This will be in Keycloak 26.
Thanks for discussion and the contributions, @mzvankovich and @magoogli !