p2-inc / keycloak-orgs

Single realm, multi-tenancy for SaaS apps
Other
361 stars 65 forks source link

Issue with Invitation Links in Admin Portal #213

Closed andreiserheichuk closed 3 months ago

andreiserheichuk commented 3 months ago

Hi Team,

I hope this message finds you well. I'm currently encountering an issue with sending invitations through the admin portal. When recipients receive the invitation message, they see the following prompt:

"To accept or reject this invitation, click on the link below to log in."

However, there are no links provided in the message for recipients to accept or reject the invitation. This is causing confusion and inconvenience for both senders and recipients.

I would like to inquire if there are any configuration settings or steps that need to be adjusted to ensure that the invitation emails contain the appropriate links for acceptance or rejection.

Thank you for your attention to this matter. I look forward to your prompt response and assistance.

Best regards, Andrei

xgp commented 3 months ago

Either set the redirect_uri in the request to create the invitation or modify the email template to include the link.

apolenur commented 3 months ago

What the link should point to, so that user can accept the invitation ?

xgp commented 3 months ago

If you enable the "Invitation" required action in the admin, it will automatically present the user a required action challenge if there are invitations present. The user just needs to log in, so any link that will cause that.

andreiserheichuk commented 3 months ago

@xgp , thank you for the explanation. Can you please share how to modify the email template? Do we have this modification functionality or should it be our own extension with overriding invitation-email.ftl page?

xgp commented 3 months ago

If you're using our docker image, our keycloak-themes extension, and the updated admin UI with the "Styles" tab should be installed, you can edit the email templates there. Otherwise, you will have to override it with your own theme extension.

andreiserheichuk commented 3 months ago

@xgp, I've observed that our invitation flow functions smoothly for existing users. However, I'm interested in a scenario where we can send an invitation to a user who hasn't been created yet. User account is automatically created upon receipt of the invitation, and then user proceed to log in, set their password, and accept the invitation seamlessly. Is such a workflow feasible within our system?

xgp commented 3 months ago

You want to do it without enabling registration?

There are a couple of people that have combined our magic link extension which can force create a user that doesn't exist, and then use that link in the email. However, if you're using the portal, you'd have to customize it to create and then pass in the link.

apolenur commented 3 months ago

And if we enable registration. How does it work ?

Thank you for all help and quick support

xgp commented 3 months ago

There is no magic. The user registers. If they use an email address that matches an invitation, it sends them to the invitation required action after their email address is verified.