Sharang ParnerkarandClaude Fable 5 67264d57ed fix(keycloak): org create must send a domain (KC 26 rejects domainless) ...

Onboarding provisioning failed at CreateOrgAndInvite with
create org: 400 "You must provide at least one domain" — Keycloak 26
requires every organization to carry at least one domain, and the
payload sent none. Membership is registry-authoritative (model B2), so
we do not use Keycloak email-domain auto-join; a synthetic per-tenant
domain <slug>.tenant.breakpilot.com satisfies the constraint, is unique
(slug is unique in the registry), and never clashes with a real
deliverable mail domain. Discovered live: with the service account now
holding manage-realm the 403 is gone and this is the next real blocker
to onboarding every customer's org on KC 26.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD

2026-09-01 11:16:19 +02:00

..

adapter.go

feat(keycloak): organizations become the membership authority source (#19)

2026-09-01 09:03:23 +00:00

client_test.go

fix(keycloak): org create must send a domain (KC 26 rejects domainless)

2026-09-01 11:16:19 +02:00

client.go

feat(keycloak): M4.3 — Admin API adapter + claim resolver

2026-05-19 11:51:09 +00:00

mock_test.go

feat(keycloak): M4.3 — Admin API adapter + claim resolver

2026-05-19 11:51:09 +00:00

mock.go

RBAC Phase 1: membership authority endpoint + fail-closed API auth (#14)

2026-08-24 18:21:46 +00:00

orgs.go

fix(keycloak): org create must send a domain (KC 26 rejects domainless)

2026-09-01 11:16:19 +02:00

users_test.go

feat(keycloak): organizations become the membership authority source (#19)

2026-09-01 09:03:23 +00:00

users.go

feat(keycloak): organizations become the membership authority source (#19)

2026-09-01 09:03:23 +00:00