Hey — we ran into the same gap and built an open-source Keycloak Authenticator SPI that handles this:

https://github.com/revspot/keycloak-select-org-authenticator

It plugs into the browser authentication flow as a post-login step and queries the user's native Keycloak 26+ Organization memberships:

• 0 orgs → denies access
• 1 org → auto-selects silently
• 2+ orgs → shows a picker page

Stores the selection in session notes (kc.org) so the built-in Organization Membership token mapper picks it up automatically. Hope it helps!