Repository navigation
Hints regarding Organization's user administration w/ FGAP #50337
Replies: 2 comments 1 reply
|
Version qualification — 20 October 2026: the original question used a nightly build. In released Keycloak 26.7.0, the Admin Console does not implement the picker for Specific Organizations (#50830). PR #51717 added The authorization model below does not imply that organization membership automatically maintains a realm-group mirror. That part requires explicit provisioning, and selecting organization resources and delegating user administration are separate concerns. You are not missing a hidden definition of “specific”. In FGAP v2, “Specific Organizations” means a fixed set of organization resources selected by the permission. It does not mean “the organization of the administrator who is currently logged in”, and it does not automatically extend the permission to that organization's users. The current member endpoints make the separation explicit. Adding an existing member requires both: auth.orgs().requireManage(organization);
auth.users().requireManage(user);Removing a member performs the same two checks. Listing members requires permission to view the organization plus permission to query users. So Organization and User authorization must be configured separately. For a static per-organization setup, I would model it as follows:
That group mirror is an explicit provisioning design, not an automatic membership synchronization feature. It must be maintained by your provisioning process. In the model described here, the current permission model does not derive a dynamic set of User resources from organization membership. Without it, selecting an organization alone cannot express “all and only users in my organization”; you would have to maintain specific User permissions or provision the organization-specific group/policies through the Admin REST API. There is also a least-privilege limitation to be aware of. Organizations currently expose only The relevant parts are documented and enforced here:
For the feature flag: FGAP v2 has been enabled by default since Keycloak 26.2. You still enable Admin Permissions for the individual realm. |
How did you achieve this? With KC 26.7.0 I am facing the issue described in #51119 and #50830 . I can't configure a FGAP permission for a specific organization because I cant select one... |
|
That group mirror you're talking about, are there any built-in means to automatically maintain group memberships in such a group? Organizations support is promising, but it's not super clear to me how permissions and policies should be configured in order to allow a self-serving scenario. In my case, I'm looking at having hundreds of organizations in a realm, and having to maintain realm-level group + organization-specific permission + organization-specific policies seems a bit cumbersome. All I need is for members of an organization-level admin group to be able to invite new members/remove existing, and decide which members are part of which organization-level groups. |
Uh oh!
There was an error while loading. Please reload this page.
ciao, i'm very new to this whole keycloak-thing, so please mind that my use of terminology might be a little off.
i'm trying to allow the administration of users that are part of an organization by other users from the same organization that are part of a group designated for that administration task while they're not having any other administration capability.
with fiddling on the nightly build (Organizations & Admin Permissions are enabled) i managed to scope that group to allow the necessary actions. but i'm struggling to get a grip how that'd be restricted to a (user's) organization. particularly when creating a Permission for an Organization the option to "Enforce access to" "Specific Organizations" is riddling as it's unclear what defines an Organization to be specific. but it seems that's what i wanna do.
i'd be happy for some pointers on what i'm missing or how to accomplish the desired setup, if possible at all.
beside, i have two minor, concrete questions:
does the bullet point Organization Self-Service mentioned here refer to the functionality i'm looking for? in the related discussion there are also mentions of Self-Management, and the associated expectations seem more diverse.
is the feature flag
admin-fine-grained-authz:v2still necessary to enable the FGAP?All reactions