B2B CIAM · Organization Onboarding
From signed contract to a working customer org
Every business customer becomes a Keycloak organization with its own domains, identity provider, admins and members. We automate the provisioning, give customers a safe way to set up SSO, and enforce seats at the moment users join.
- One organization per customer
- Per-customer SSO and domains
- Seats enforced at membership
Standards & integrations
- Keycloak Organizations
- SAML 2.0
- OpenID Connect
- SCIM 2.0
- Admin REST API
- Terraform
Overview
What onboarding an organization involves
Creating the organization is the easy part. It also needs a stable identifier shared with CRM and the entitlement service, domains that route users to the right login, an identity provider for customers who bring their own, a first administrator, and a rule for how every later user joins — and whether a seat is free when they do. We build that as an idempotent, automated workflow, with a self-service admin portal on top of Keycloak's Admin REST API.
What we deliver
- Tenancy model: realms, organizations and identifiers
- Automated organization provisioning workflow
- Org admin portal for invites, roles and SSO setup
- Identity provider templates for common customer IdPs
- Seat-aware invitation, JIT and SCIM onboarding paths
- Lifecycle runbook: suspend, reactivate, terminate, purge
Capabilities
What Organization Onboarding covers
Configured, tested and documented on upstream Keycloak — then handed over or operated by us.
Automated provisioning
The orchestrator creates the organization, domains, attributes and first-admin invitation from a CRM event, keyed on the CRM account ID so retries never duplicate.
Per-customer SSO
Customers bring Entra ID, Okta, Google Workspace or any SAML or OIDC IdP, linked to their organization and routed by email domain.
Self-service SSO setup
An org admin portal lets customer IT upload metadata and test their connection through the Admin REST API — Keycloak has no built-in customer SSO wizard.
Invitations and just-in-time joining
Admins invite users by email through Keycloak's organization invitations; SSO users can join on first login where the seat policy allows.
SCIM provisioning
Customer IdPs push and remove users through a SCIM extension, so leavers lose access without a support ticket.
Suspension and termination
Suspended organizations are denied at login and their sessions revoked; terminated ones lose members and IdPs, then are purged after the retention period.
Onboarding paths
How users join an organization
Every way a user can join, and where the seat check happens.
| Path | How membership is created | Seat check |
|---|---|---|
| Admin invitation | Keycloak organization invitation, accepted by email | Seat reserved before the invitation is sent |
| SSO just-in-time | Membership on first login through the organization's IdP | Authenticator at first login; refused if full |
| SCIM provisioning | Customer IdP pushes users through a SCIM extension | At provisioning — rejected or flagged |
| Self sign-up | Registration inside the organization's login | Pre-check, or at first login |
| B2C sign-up | No organization; the user is the subscriber | Entitlement attached to the user |
| Migration | Created by the migration service before cutover | Counted against the existing entitlement |
How it works
From first call to production
Design the tenancy model
We agree one organization per customer, a realm per region and environment, shared identifiers, domains and organization lifecycle states.
Automate provisioning
The onboarding workflow and admin portal are built against the Admin REST API, with realm configuration managed in Terraform.
Enable customer SSO and invites
SSO onboarding, invitations, just-in-time joining and SCIM are tested end to end with real customer IdPs.
Use cases
Where teams put it to work
Enterprise customers with their own IdP
Each customer signs in through their own Entra ID or Okta, routed automatically by email domain.
SMB customers without SSO
Admins invite colleagues by email, and users sign in with passwords, passkeys or social login inside their organization.
Hundreds of customer organizations
Onboarding runs from CRM events without anyone clicking through the admin console.
FAQ
Organization Onboarding questions, answered
One realm per customer, or one organization per customer?
Organizations in a shared realm by default: low operational cost, per-customer SSO and the organization in every token. A dedicated realm or cluster is kept for customers who contractually need hard isolation or specific data residency.
How do we stop SSO users exceeding their seats?
Seats are checked when a user joins — at invitation, SCIM provisioning or first SSO login — by a Keycloak authenticator that asks the entitlement service. If the organization is full, sign-in is refused with a clear message.
Can a user belong to more than one organization?
Yes. A Keycloak user can be a member of several organizations; the login flow establishes which one they're acting in, and the token carries that organization.
Ready to roll out Organization Onboarding?
Walk us through your requirements on a free strategy call. We'll come back with an architecture, a delivery plan and a fixed scope.