Repository navigation
Implement organization-specific admin roles with limited permissions #31641
Description
Description
It would be helpful to have the ability to assign admin roles specifically for organization management. These roles should have limited permissions compared to realm administrators. Organization admins should be able to:
- Invite new users to the organization
- Assign predefined roles to new and existing users within the organization
- Remove users from the organization
Key points:
- These admin roles should be defined and managed at the organization level
- Organization admins should not have access to change realm settings
- Only full system administrators or organization owners should be able to assign these admin roles
This feature will improve delegation of administrative tasks within organizations
Discussion
Motivation
No response
Details
No response
Reacted by 4FunAndProfit, Marcus Dunn, Roland, Xabi, fosple, m.uowis, Erwin van Dam, Aaron Plave, Bill Howe and Aymeric
Metadata
Metadata
Assignees
Labels
Type
Fields
Value
None yet
Effort
None yet
Votes
None yet
Activity
pedroigor commentedon Aug 21, 2024
We won't be able to deliver this capability now in Keycloak 26 but it is related to
Administrative Authorizationas per #30180.One thing we need to discuss is how this will overlap with the
Organization Self-Service. Do you think it will be enough to address the use case you are trying to solve?Degoya-Studio commentedon Aug 21, 2024
@pedroigor I'm not sure how Organization Self-Service will work, but I can try to explain my use case.
Let's say again my users are personnel at medical practices. Each practice should have an organization in KeyCloak in order for its staff to log in. There should be two roles an organization member can have - coordinator and personnel. When I create the organization in Keycloak, I want to assign an user a role as coordinator, in order for them to invite other members to their organization, as well as give other users the role of a coordinator. However, I don't want to give them complete realm access rights.
Will I be able to archive this with either Organization Self-Service or later on with Administrative Authorization?
rasos commentedon Dec 10, 2024
Our use case is quite similar: We are offering a suite of open source tools to several organizations. They should be able to self-manage their users. Not all organizations have a dedicated e-mail address domain, so we need organization administrators who should be able to assign or remove members without having full access to the realm settings.
rasos commentedon Jul 24, 2025
Manage Organization Roles PR #40586
vramik commentedon Mar 17, 2026
#45497
11 remaining items
Introduce manage-organizations, view-organizations admin roles for Or…
Introduce manage-organizations, view-organizations admin roles for Or…
OSAC-478: Enable Admin Permissions in Keycloak Chart
Introduce manage-organizations, view-organizations admin roles for Or…