B2B CIAM: Organizations & Entitlements

One Keycloak organization per customer, a custom entitlement service for products, plans and seats, and OpenFGA for fine-grained access. Customers are provisioned automatically the moment a deal closes in your CRM.

Overview

We build the complete B2B customer identity stack around one rule: every fact has exactly one owner. Keycloak owns identities, organizations, memberships and tokens that carry the organization. A custom entitlement service owns what each customer bought: products, plans, features, seats and validity, fed by CRM and billing events. OpenFGA owns resource-level relationships, with a model that ties every grant to organization membership and an active product license. At login, a Keycloak authenticator checks the organization's entitlement for the requested product and adds a lean claim to the token. At every API, the token is validated, the organization is enforced down to row-level security, and resource decisions go to OpenFGA. Onboarding runs from a closed-won event through an idempotent saga that creates the subscriber, entitlements, Keycloak organization and first-admin invitation, and existing users move in org by org with their passwords intact. The same design supports individual (B2C) subscribers, and it's the blueprint we use when moving Auth0 Organizations customers to Keycloak.

Delivery Process

What's Included

• Keycloak Organizations tenancy model with per-customer SSO
• Entitlement service: products, plans, seats and validity
• Login-time entitlement check and lean token claims
• CRM-to-organization onboarding saga (Salesforce / billing events)
• OpenFGA authorization model with sync and reconciliation
• Org-by-org user migration with password hashes preserved

Timeline & Scope

Tech Stack