[Discussion] - Organizations feature in Keycloak

[thomasdarimont]

When looking for the term Organizations in the Keycloak project discussions a few of discussions centering around support for an organizations concept come up.

Are there any plans to contribute the organizations feature upstream to the Keycloak project?

[xgp]

Hi @thomasdarimont Thanks for the link to the discussions. I didn't realize this was something people were talking about there. I would be interested in contributing some or all of this feature upstream to Keycloak, however, there are many people using it as-is, so it would be difficult to significantly change the functionality. Also, a couple of things I see that would make it difficult:

• the storage is based on the "old" JPA store type
• this is largely focused on allowing organizations to "own" IdPs and Domains, something that is specific to SaaS apps
• the organization-roles hierarchy is independent of the Keycloak roles, and doesn't not (currently) interoperate with them in any way
• invitations is a bit of a hack, in that it creates a new user before they have actually accepted the invitation

However, I'd be happy to write up a proposal, even to see it picked apart. :wink: Do you have examples, or could you help me with such a proposal?

[xgp]

Related: https://groups.google.com/u/2/g/keycloak-dev/c/-L3p4amjaHA

[xgp]

Discussions about doing this in Keycloak:

• https://github.com/keycloak/keycloak/discussions/19055
• https://github.com/keycloak/keycloak/discussions/19054

[xgp]

Related: https://github.com/keycloak/keycloak/discussions/23948

[xgp]

The Keycloak team decided to build themselves with a different set of features. We'll update the README with a note as we understand what they're building so that there is a good reference for how the two are different.