Sharang ParnerkarandClaude Fable 5
67264d57ed
Onboarding provisioning failed at CreateOrgAndInvite with create org: 400 "You must provide at least one domain" — Keycloak 26 requires every organization to carry at least one domain, and the payload sent none. Membership is registry-authoritative (model B2), so we do not use Keycloak email-domain auto-join; a synthetic per-tenant domain <slug>.tenant.breakpilot.com satisfies the constraint, is unique (slug is unique in the registry), and never clashes with a real deliverable mail domain. Discovered live: with the service account now holding manage-realm the 403 is gone and this is the next real blocker to onboarding every customer's org on KC 26. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD