platform/tenant-registry
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(keycloak): org create must send a domain (KC 26 rejects domainless) #20

Merged
sharang merged 1 commits from fix/org-create-requires-domain into main 2026-09-01 09:18:15 +00:00
Conversation 0 Commits 1 Files Changed 2
+25
sharang commented 2026-09-01 09:16:21 +00:00
Owner
Copy Link
Copy Source

Second real onboarding bug found while provisioning the Auth-5 matrix on the org-enabled realm. After granting the service account manage-realm (403 gone), CreateOrgAndInvite failed with create org: 400 "You must provide at least one domain". Keycloak 26 requires an organization to carry at least one domain; the payload sent none, so onboarding cannot provision ANY customer org.

Fix: send a synthetic per-tenant domain .tenant.breakpilot.com (verified:false). Safe under model B2 (registry is the membership authority; we do not use KC email-domain auto-join), unique because the slug is unique in the registry, and never collides with a real customer mail domain (which could be a shared public domain).

Test: the happy-path createOrgAndInvite test now captures the POST body and asserts the domain is present. Full suite green with -race, coverage 71.1% (gate 70).

Second real onboarding bug found while provisioning the Auth-5 matrix on the org-enabled realm. After granting the service account manage-realm (403 gone), CreateOrgAndInvite failed with create org: 400 "You must provide at least one domain". Keycloak 26 requires an organization to carry at least one domain; the payload sent none, so onboarding cannot provision ANY customer org. Fix: send a synthetic per-tenant domain <slug>.tenant.breakpilot.com (verified:false). Safe under model B2 (registry is the membership authority; we do not use KC email-domain auto-join), unique because the slug is unique in the registry, and never collides with a real customer mail domain (which could be a shared public domain). Test: the happy-path createOrgAndInvite test now captures the POST body and asserts the domain is present. Full suite green with -race, coverage 71.1% (gate 70).
sharang added 1 commit 2026-09-01 09:16:21 +00:00
fix(keycloak): org create must send a domain (KC 26 rejects domainless)
ci / shared (pull_request) Successful in 11s
Details
ci / test (pull_request) Successful in 21m24s
Details
ci / image (pull_request) Skipped
Details
67264d57ed 
Onboarding provisioning failed at CreateOrgAndInvite with
create org: 400 "You must provide at least one domain" — Keycloak 26
requires every organization to carry at least one domain, and the
payload sent none. Membership is registry-authoritative (model B2), so
we do not use Keycloak email-domain auto-join; a synthetic per-tenant
domain <slug>.tenant.breakpilot.com satisfies the constraint, is unique
(slug is unique in the registry), and never clashes with a real
deliverable mail domain. Discovered live: with the service account now
holding manage-realm the 403 is gone and this is the next real blocker
to onboarding every customer's org on KC 26.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD
sharang merged commit 80565fdbf2 into main 2026-09-01 09:18:15 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: platform/tenant-registry#20