[Sub Organization Login] An administrator with only the organization permissions cannot access the console

[GoushiRam]

Describe the issue: We have 2 sets of permissions when creating an administrator role,

1. Root organization permissions
2. Organization permissions

When we create am admin role with organization permissions, and the role is assigned to a parent admin, he is unable to access the organization.

How to reproduce:

1. Create an admin role with only organization permissions
2. Create a user in the root org
3. Invite the user to a b2b organization
4. Within the b2b organization, assign the invited user with the admin role created in Step 1
5. Navigate to the console via root org, sub org and see if the above user can access the sub organization

Recording: https://drive.google.com/file/d/1RjGRiVIkBeGu0zWXEL5AucXyvRABkN1u/view?usp=sharing

Expected behavior: Ideally the org administrator with the organization permissions should have access to login to the organization console

I am adding it as Critical since there are few alternatives:

1. Providing the admin with root org permission "Organization" so that he can log into console and switch - this exposes the existing sub organizations

Environment information (Please complete the following information; remove any unnecessary fields) :

• Product Version: [e.g., IS 5.10.0, IS 5.9.0]
• OS: [e.g., Windows, Linux, Mac]
• Database: [e.g., MySQL, H2]
• Userstore: [e.g., LDAP, JDBC]

---

Optional Fields

Related issues:

Suggested labels:

[dewniMW]

Users residing in the parent organization and invited to the sub-organization are expected to be unable to directly access the sub-organization's console. This is because the user's credentials are managed within their resident organization.

[GoushiRam]

Had a quick discussion with @malithie regarding the behavior, specifically focusing on accommodating scenarios where a user from root organization, who has been invited as an admin user in the sub org with organization-level permissions, needs to log in to the root organization console (where the user base is managed) but should be seamlessly redirected to the sub-organization they manage. The challenge lies in maintaining a cohesive application experience within the console, including branding elements, which can sometimes lead to confusion for users.

Currently, this concern can be addressed with the workaround mentioned in this git issue. However, we need to revisit this use case as part of our planned revamp of B2B console access in the future.

cc: @AnuradhaSK @dewniMW @sadilchamishka