Admin Portal Docs
The Phase Two Admin Portal allows you to offer self-management of User Profile and Organization features to your customers from within your application with almost no code. A portal link can be generated in your application that will take a logged in user to the Admin Portal. The appropriate configuration to activate the Admin Portal are installed by default. You can customize style and visibility of the portal using the guides below.
Component guides
Membership
Users who are associated with an organization are considered members. The relationship of users to organizations can be managed in the Organizations tab of the Admin UI. Invitations also provide a way to allow organization administrators to invite new members to the organization. If you are associating an identity provider with an organization, all users who authenticate through an associated identity provider will automatically be added as members to the organization.
Attributes
Attributes functionality provides key-value storage of Organization attributes that can be used in your application to customize experience. The ability to manage attributes is available in the Organizations tab of the Admin UI.
Configuration
The Organizations extension has a set of realm-level configuration settings that control how organizations behave across your deployment.
Invitations
Invitations provide a way to allow Keycloak and organization administrators to invite new members to the organization.
Roles
Members of an organization can have role assignments that are specific to that organization. These are separate from Keycloak realm and client roles, and do not inherit from them. There are a set of default roles that control access to functionality within Phase Two, and additional roles can be added for your application purposes. Role creation, management and assigment can be done in the Organizations tab of the Admin UI.
IdP Wizard
The Organization IdP Wizard allows members of an organization with the right roles to self-manage their organization's SSO configuration. It provides guided setup for identity providers without requiring direct access to the full Keycloak admin UI.
Identity Providers
Identity providers (IdPs) can be associated with an organization for the purpose of directing users to authenticate with the IdP via a verified email domain, and for automatically granting membership to users who authenticate with that IdP.
Automatic IdP Redirection
Automatic IdP redirection lets you route users to the correct organization-specific identity provider based on their email domain. This is a common setup for B2B SaaS applications where each customer organization manages its own SAML or OIDC provider.
SCIM
SCIM 2.0 lets upstream identity providers (Okta, Microsoft Entra ID, OneLogin, JumpCloud, Google Workspace, etc.) push users into your application automatically. When IT adds someone to a group in their IdP, SCIM provisions that user. When they remove someone, SCIM de-provisions them. Without SCIM you are relying on just-in-time provisioning at login, which means a fired employee can still sign in until somebody manually disables their account.
Admin Portal
The Phase Two Admin Portal allows you to offer self-management of User Profile and Organization features to your customers from within your application with almost no code. A portal link can be generated in your application that will take a logged in user to the Admin Portal. The appropriate configuration to activate the Admin Portal are installed by default. You can customize style and visibility of the portal using the guides below.
Token Mappers
Token mappers allow you to map information about the user, their organization, or other attributes into the access token, ID token, or userinfo endpoint response. This can be useful for applications that need to know about the user's organization or other attributes in order to make authorization decisions.
Active Organization
Currently supported mode
Active Organization Authenticator
Note that to have the active_organization information in tokens, you need the "Active Organization" mapper.
Import/Export
Import
Events
Admin Events