Add custom attributes support to organization invitations by kota65535 · Pull Request #48842 · keycloak/keycloak

kota65535 · 2026-05-08T15:18:18Z

Closes: #48837

Summary

Add key-value custom attributes to organization invitations
Add application/json request body support to invite-user and invite-existing-user endpoints
Preserve attributes on invitation resend
Add Admin UI for managing invitation attributes with a 2-step modal flow

Changes

Backend

New ORG_INVITATION_ATTRIBUTE table (jpa-changelog-26.7.0.xml) with FK cascade delete
New OrganizationInvitationAttributeEntity JPA entity
Extend OrganizationInvitationModel SPI with getAttributes() / setAttribute() / removeAttribute()
Extend InvitationManager.createInvitation() with optional attributes parameter (backward-compatible default method)
Add JSON @Consumes variants for invite-user and invite-existing-user endpoints alongside existing application/x-www-form-urlencoded endpoints
New request types: OrganizationInvitationUserRequest, OrganizationInvitationExistingUserRequest
Add attributes field to OrganizationInvitationRepresentation

Admin UI

InviteMemberModal: switch from FormData to JSON body, add key-value attributes input (single-step flow for email invitations)
InvitationAttributesModal: reusable attributes modal shared across all invite flows
Invitations.tsx: 2-step flow using MemberModal (user selection) → InvitationAttributesModal (attributes) for existing user invitations
Organizations.tsx (user detail page): 2-step flow using OrganizationModal (org selection) → InvitationAttributesModal (attributes)
Invitations: show attributes count with tooltip displaying key-value details on hover

Organization details → Invite new user

Using InviteMemberModal:

Organization details → Invite existing user

Using OrganizationModal and InvitationAttributesModal (2-step flow):

↓

User details → Send invitation

Using MemberModal and InvitationAttributesModal (2-step flow):

↓

Attributes in an invitation list

Showing the number of the attributes:

Showing the attribute in a tooltip on hover:

Admin Client (JS)

Add InviteUserRequest / InviteExistingUserRequest type definitions
Add inviteUserJson / inviteExistingUserJson methods to organizations resource

Tests

Invitation creation and retrieval with attributes
Invitation resend preserves attributes
Backward compatibility without attributes
Existing user invitation with attributes
Tests written using the new test framework (tests/base/)

API

POST /admin/realms/{realm}/organizations/{id}/members/invite-user
Content-Type: application/json

{
  "email": "user@example.com",
  "firstName": "John",
  "lastName": "Doe",
  "attributes": {
    "department": ["engineering"],
    "role": ["developer", "reviewer"]
  }
}

POST /admin/realms/{realm}/organizations/{id}/members/invite-existing-user
Content-Type: application/json

{
  "id": "<user-id>",
  "attributes": {
    "department": ["engineering"]
  }
}

Migration

New ORG_INVITATION_ATTRIBUTE table added in jpa-changelog-26.7.0.xml
No impact on existing data

Backward Compatibility

Existing application/x-www-form-urlencoded endpoints remain unchanged
InvitationManager SPI maintains existing method signatures via default methods
Invitations without attributes continue to work as before

AI-assisted development was used in this PR with Claude Code. All changes have been reviewed
and are understood by the author.

edewit

other then some small nit picks looks good from a UI perspective

edewit · 2026-05-11T08:49:16Z

+      const attributes = keyValueToArray(data.attributes);
+      await adminClient.organizations.inviteUserJson(
+        { orgId },
+        {
+          email: data.email,
+          firstName: data.firstName,
+          lastName: data.lastName,
+          attributes:
+            Object.keys(attributes).length > 0 ? attributes : undefined,
+        },
+      );


bit of a nit pick, but this could be a lot shorter:

Suggested change

const attributes = keyValueToArray(data.attributes);

await adminClient.organizations.inviteUserJson(

{ orgId },

{

email: data.email,

firstName: data.firstName,

lastName: data.lastName,

attributes:

Object.keys(attributes).length > 0 ? attributes : undefined,

},

);

const { attr, ...rest } = data;

const attributes = keyValueToArray(attr) && undefined;

await adminClient.organizations.inviteUserJson({ orgId }, { ...rest, attributes })

Thank you, attributes should be undefined if it is empty here, but with this code keyValueToArray(attr) && undefined doesn't return undefined because an empty object {} is truthy.

but it's an array not an object [] && undefined returns undefined

Thank you for sharing the snippet, but the return type of keyValueToArray function appears to be Object.

keycloak/js/apps/admin-ui/src/components/key-value-form/key-value-convert.ts

Line 7 in 087e03b

const result: Record<string, string[]> = {};

ohh right but then my version is still a bit shorter:

const { attr, ...rest } = data; const attributes = keyValueToArray(attr); await adminClient.organizations.inviteUserJson({ orgId }, { ...rest, attributes: Object.keys(attributes).length ? attributes : undefined });

but couldn't we fix it on the server that when attributes is an empty object it would still work?

Oh, it works even with an empty map. I've simplified this.
https://github.com/keycloak/keycloak/pull/48842/changes#diff-aa6e7e0717a4bf2e09aa5dc5bdd4a4bcb4f9171eca199747c73f8226572f5b36R48

kota65535 · 2026-05-13T19:47:06Z

@keycloak/maintainers Could someone also review the backend/model/API parts of this PR?
This PR changes the invitation model, JPA entity/changelog, admin resource, admin client API and tests, in addition to the Admin UI changes.

Copilot

Pull request overview

This PR adds end-to-end support for custom key-value attributes on organization invitations, spanning persistence (new DB table + JPA entities), admin REST API (JSON request bodies + representation updates), admin client typings, Admin UI flows for entering attributes, and integration tests validating creation/resend behavior.

Changes:

Persist invitation attributes in a new ORG_INVITATION_ATTRIBUTE table and expose them via the invitation representation.
Add JSON application/json variants for invite-user / invite-existing-user endpoints while keeping form-encoded variants for backward compatibility.
Update Admin UI invite flows to collect attributes (single-step for email invites, 2-step modal for existing-user invites) and display attribute counts/details in the invitations list.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/base/src/test/java/org/keycloak/tests/organization/admin/OrganizationInvitationAttributeTest.java	Adds integration tests covering invitation attributes creation/resend/empty/null behaviors.
services/src/main/java/org/keycloak/organization/admin/resource/OrganizationMemberResource.java	Adds JSON-consuming invite endpoints delegating to invitation resource.
services/src/main/java/org/keycloak/organization/admin/resource/OrganizationInvitationResource.java	Threads attributes through invite/create/resend and includes them in representations.
server-spi/src/main/java/org/keycloak/organization/InvitationManager.java	Extends invitation creation SPI to accept optional attributes (with backward-compatible default).
server-spi/src/main/java/org/keycloak/models/OrganizationInvitationModel.java	Adds invitation attributes accessor to the model SPI.
model/jpa/src/main/resources/META-INF/jpa-changelog-26.7.0.xml	Adds Liquibase change set creating `ORG_INVITATION_ATTRIBUTE` with FK cascade delete + index.
model/jpa/src/main/resources/default-persistence.xml	Registers the new JPA entity for persistence.
model/jpa/src/main/java/org/keycloak/organization/jpa/JpaInvitationManager.java	Persists invitation attributes during invitation creation.
model/jpa/src/main/java/org/keycloak/models/jpa/entities/OrganizationInvitationEntity.java	Adds `@OneToMany` relationship and exposes attributes as `Map<String, List<String>>`.
model/jpa/src/main/java/org/keycloak/models/jpa/entities/OrganizationInvitationAttributeEntity.java	New JPA entity mapping for invitation attributes.
model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/InfinispanInvitationManager.java	Forwards attribute-aware create calls to delegate manager.
js/libs/keycloak-admin-client/src/resources/organizations.ts	Expands invite request payload typing to allow JSON request bodies.
js/libs/keycloak-admin-client/src/defs/organizationInvitationRequest.ts	Adds admin-client request type definitions for JSON invite endpoints.
js/libs/keycloak-admin-client/src/defs/organizationInvitationRepresentation.ts	Adds `attributes` to JS invitation representation type.
js/apps/admin-ui/src/user/Organizations.tsx	Implements 2-step “select orgs → set attributes” flow for inviting an existing user.
js/apps/admin-ui/src/organizations/OrganizationModal.tsx	Updates confirm label to “next” for 2-step flow.
js/apps/admin-ui/src/organizations/InviteMemberModal.tsx	Switches email-invite to JSON body and adds attribute input.
js/apps/admin-ui/src/organizations/Invitations.tsx	Implements 2-step invite flow for existing users and displays attributes count/tooltip.
js/apps/admin-ui/src/organizations/InvitationAttributesModal.tsx	New modal for entering invitation attributes.
js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties	Adds i18n string for the attributes modal title.
integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationMembersResource.java	Adds JSON `@Consumes` methods for invite endpoints in the Java admin client.
core/src/main/java/org/keycloak/representations/idm/OrganizationInvitationUserRequest.java	New request DTO for JSON email-invite including attributes.
core/src/main/java/org/keycloak/representations/idm/OrganizationInvitationRepresentation.java	Adds `attributes` to the invitation representation.
core/src/main/java/org/keycloak/representations/idm/OrganizationInvitationExistingUserRequest.java	New request DTO for JSON existing-user invite including attributes.

kota65535 · 2026-06-25T12:26:29Z

Hi @edewit, sorry for another ping.

This PR seems to touch a few areas beyond the Admin UI, so I’m not sure whether you’re the only reviewer needed here. Could you please help forward this to the right maintainers, or let me know who I should ask for review?

Thanks!

edewit

looks good from a UI point of view

kota65535 · 2026-06-26T05:02:20Z

@edewit I'm so sorry, I pushed a commit to the wrong branch by mistake, which caused the approval to be dismissed. Could you please approve it again?

Copilot

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 5 comments.

Signed-off-by: Tomohiko Ozawa <kota65535@gmail.com>

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-24T06:35:22Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Keycloak CI - Forms IT (chrome)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Keycloak CI - Forms IT (chrome)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

kota65535 · 2026-07-24T09:20:48Z

Hi @pedroigor, I am mentioning you because this feature is related to Keycloak Organizations. I have resolved all of Copilot's comments and confirmed that all tests pass. Could you please review this PR or assign an appropriate reviewer so that it can be merged?

kota65535 force-pushed the vk/e990-invitation-attri branch 2 times, most recently from 9691030 to c00970f Compare May 8, 2026 15:52

kota65535 changed the title ~~Add custom attributes support to organization invitations~~ feat: add custom attributes support to organization invitations May 8, 2026

keycloak-github-bot Bot added the flaky-test label May 8, 2026

keycloak-github-bot Bot mentioned this pull request May 8, 2026

Flaky test: org.keycloak.testsuite.forms.RPInitiatedFrontChannelLogoutTest#testFrontChannelLogoutWithoutSessionRequired #48647

Closed

kota65535 force-pushed the vk/e990-invitation-attri branch 4 times, most recently from 5c0f2b1 to c51e773 Compare May 8, 2026 18:24

kota65535 marked this pull request as ready for review May 8, 2026 19:46

kota65535 requested review from a team as code owners May 8, 2026 19:46

keycloak-github-bot Bot added the team/ui label May 8, 2026

kota65535 changed the title ~~feat: add custom attributes support to organization invitations~~ Add custom attributes support to organization invitations May 9, 2026

edewit previously approved these changes May 11, 2026

View reviewed changes

kota65535 dismissed edewit’s stale review via f0d0519 May 11, 2026 10:19

kota65535 force-pushed the vk/e990-invitation-attri branch 2 times, most recently from cf3d202 to 8c9ec01 Compare May 12, 2026 00:07

kota65535 mentioned this pull request May 13, 2026

Support attaching roles to user invitations (organization / realm level) #45238

Open

kota65535 force-pushed the vk/e990-invitation-attri branch from 8c9ec01 to 22dd211 Compare May 13, 2026 17:46

kota65535 requested a review from edewit May 13, 2026 19:12

kota65535 force-pushed the vk/e990-invitation-attri branch 2 times, most recently from 62c66a1 to 4878832 Compare May 13, 2026 19:41

stianst added team/core-iam and removed team/ui labels May 21, 2026

Copilot AI review requested due to automatic review settings June 25, 2026 12:19

kota65535 force-pushed the vk/e990-invitation-attri branch from 4878832 to 93fed69 Compare June 25, 2026 12:19

Copilot started reviewing on behalf of kota65535 June 25, 2026 12:20 View session

Copilot AI reviewed Jun 25, 2026

View reviewed changes

edewit previously approved these changes Jun 25, 2026

View reviewed changes

keycloak-github-bot Bot mentioned this pull request Jun 25, 2026

Flaky test: org.keycloak.testsuite.saml.SamlClientTest#testLoginWithOIDCClient #49985

Closed

kota65535 dismissed edewit’s stale review via 546304e June 26, 2026 04:58

kota65535 requested review from a team as code owners June 26, 2026 04:58

Copilot AI review requested due to automatic review settings June 26, 2026 04:59

kota65535 force-pushed the vk/e990-invitation-attri branch from 546304e to 93fed69 Compare June 26, 2026 04:59

Copilot started reviewing on behalf of kota65535 June 26, 2026 04:59 View session

Copilot AI reviewed Jun 26, 2026

View reviewed changes

keycloak-github-bot Bot mentioned this pull request Jun 26, 2026

Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest #49944

Closed

Copilot AI review requested due to automatic review settings July 16, 2026 16:09

kota65535 force-pushed the vk/e990-invitation-attri branch from 93fed69 to 86d947f Compare July 16, 2026 16:09

Copilot started reviewing on behalf of kota65535 July 16, 2026 16:15 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

kota65535 force-pushed the vk/e990-invitation-attri branch from 86d947f to 4f6eb59 Compare July 24, 2026 04:49

Add custom attributes support to organization invitations

e5cab70

Signed-off-by: Tomohiko Ozawa <kota65535@gmail.com>

kota65535 force-pushed the vk/e990-invitation-attri branch from 4f6eb59 to e5cab70 Compare July 24, 2026 05:33

keycloak-github-bot Bot mentioned this pull request Jul 24, 2026

Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRequiredAction #51073

Open

keycloak-github-bot Bot reviewed Jul 24, 2026

View reviewed changes

Merge branch 'main' into vk/e990-invitation-attri

f06dabc

Uh oh!

Conversation

kota65535 commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Backend

Admin UI

Organization details → Invite new user

Organization details → Invite existing user

User details → Send invitation

Attributes in an invitation list

Admin Client (JS)

Tests

API

Migration

Backward Compatibility

Uh oh!

edewit left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

edewit May 11, 2026

Choose a reason for hiding this comment

Uh oh!

kota65535 May 11, 2026

Choose a reason for hiding this comment

Uh oh!

edewit May 11, 2026

Choose a reason for hiding this comment

Uh oh!

kota65535 May 11, 2026

Choose a reason for hiding this comment

Uh oh!

edewit May 11, 2026

Choose a reason for hiding this comment

Uh oh!

kota65535 May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kota65535 commented May 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kota65535 commented Jun 25, 2026

Uh oh!

edewit left a comment

Choose a reason for hiding this comment

Uh oh!

kota65535 commented Jun 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

kota65535 commented May 8, 2026 •

edited

Loading