keycloak-admin 1.1.5 → 1.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc70b33efe8f4293f7eb0f60eeb30f9468d7866a08e20180b6a3b66c35c96ea8
-  data.tar.gz: f9cfd0bec183db13053ecd034c4c0c180a8564c116fdb6ace4271a086622f18b
+  metadata.gz: db97e606c0a299c2daff7be37a2df4a1c2a7261d2430b62dd196b8d29dc9117d
+  data.tar.gz: a1581e41e26b30d576273036ccf87abf463db0e4a80cd1f3a0961b87f874c373
 SHA512:
-  metadata.gz: a3a4bf1e49ea91c845458186565f68636244e515a7ad78d12e69c50ad190de94fd38050a3222ed16eb33f0b5a13d5e1aa65e496ebb48fb732a5248ff6c227953
-  data.tar.gz: b60ee39f400e84c57f1627042abbb07b0ca820471d3fe53448c09a2ef8b4cc1acb193ea4f11d63d4b60941f0ee9496ecb6a5fc89bc6007fa1c1eca69a5b37925
+  metadata.gz: 33416a0ad66f8f054a2192f560fbd72d6d68d1a29101521d8bfa2be5bd705888f46740d325ee265ef0e983bbd611901e7902db2a14f5693bd066c250692bb417
+  data.tar.gz: 6e17f0a84457d4bf8ce7332b756b0892fbe51a606a8895e5434fca458d9b936594006057820fb3e753d1713b5fdd895fe546f82f90a60fea948f3065e4905bed

data/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.6] - 2026-01-05
+
+* [Feature] Support for Organizations (Multi-tenancy):
+    * **Organization Management**:
+        * Supported operations: `create!`, `update`, `get`, `delete`, `list`, and `count`.
+        * Supported searching and filtering via `exact`, `query`, and `search` parameters.
+    * **Member Management**:
+        * Added ability to list organization members with pagination and filtering (`members`).
+        * Added `members_count` to retrieve the total number of members.
+        * Added `get_member`, `add_member` (by user ID), and `delete_member`.
+        * Added helper to find all organizations associated with a specific user: `associated_with_member`.
+    * **Invitations**:
+        * Added `invite_user`: Invites a new user via email/name.
+        * Added `invite_existing_user`: Invites an existing Keycloak user to the organization by ID.
+    * **Identity Provider (IdP) Linking**:
+        * Added methods to manage IdPs linked to an organization: `identity_providers`, `get_identity_provider`, `add_identity_provider`, and `delete_identity_provider`.
+
 ## [1.1.5] - 2026-01-05
 
 * [Feature] Added the ability to list credentials for a given user.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    keycloak-admin (1.1.5)
+    keycloak-admin (1.1.6)
       http-cookie (~> 1.0, >= 1.0.3)
       rest-client (~> 2.0)
 

data/README.md

@@ -12,7 +12,7 @@ This gem *does not* require Rails.
 For example, using `bundle`, add this line to your Gemfile.
 
 ```ruby
-gem "keycloak-admin", "1.1.5"
+gem "keycloak-admin", "1.1.6"
 ```
 
 ## Login
@@ -135,6 +135,11 @@ All options have a default value. However, all of them can be changed in your in
 * Execute actions emails
 * Send forgot passsword mail
 * Client Authorization, create, update, get, delete Resource, Scope, Policy, Permission, Policy Enforcer
+* Get list of organizations, create/update/get/delete an organization
+* Get list of members of an organization, add/remove members
+* Invite new or existing users to an organization
+* List, add, and remove Identity Providers for an organization
+* Get list of organizations associated with a specific user
 
 ### Get an access token
 
@@ -252,6 +257,12 @@ user_id = "95985b21-d884-4bbd-b852-cb8cd365afc2"
 KeycloakAdmin.realm("a_realm").users.get_redirect_impersonation(user_id)
 ```
 
+### List all the organizations of a realm
+
+```ruby
+KeycloakAdmin.realm("a_realm").organizations.list
+```
+
 ### Exchange a configurable token
 
 *Requires your Keycloak server to have deployed the Custom REST API `configurable-token`* (https://github.com/looorent/keycloak-configurable-token-api)

data/lib/keycloak-admin/client/organization_client.rb

@@ -0,0 +1,245 @@
+module KeycloakAdmin
+  class OrganizationClient < Client
+    def initialize(configuration, realm_client)
+      super(configuration)
+      raise ArgumentError.new("realm must be defined") unless realm_client.name_defined?
+      @realm_client = realm_client
+    end
+
+    # This endpoint does not return members
+    def list(brief_representation=true, exact=nil, first=nil, max=nil, query=nil, search=nil)
+      response = execute_http do
+        RestClient::Resource.new(organizations_url_with_parameters(brief_representation, exact, first, max, query, search), @configuration.rest_client_options).get(headers)
+      end
+      JSON.parse(response).map { |organization_as_hash| OrganizationRepresentation.from_hash(organization_as_hash) }
+    end
+
+    def count(exact=nil, query=nil, search=nil)
+      response = execute_http do
+        RestClient::Resource.new(count_url(exact, query, search), @configuration.rest_client_options).get(headers)
+      end
+      response.to_i
+    end
+
+    def delete(organization_id)
+      execute_http do
+        RestClient::Resource.new(organization_url(organization_id), @configuration.rest_client_options).delete(headers)
+      end
+      true
+    end
+
+    def update(organization_representation)
+      execute_http do
+        RestClient::Resource.new(organization_url(organization_representation.id), @configuration.rest_client_options).put(
+          create_payload(organization_representation), headers
+        )
+      end
+
+      get(organization_representation.id)
+    end
+
+    def create!(name, alias_name, enabled, description, redirect_url=nil, domains=[], attributes={})
+      save(build(name, alias_name, enabled, description, redirect_url, domains, attributes))
+    end
+
+    # This operation does not associate members and identity providers
+    def save(organization_representation)
+      execute_http do
+        RestClient::Resource.new(organizations_url, @configuration.rest_client_options).post(
+          create_payload(organization_representation), headers
+        )
+      end
+      true
+    end
+
+    def get(organization_id)
+      response = execute_http do
+        RestClient::Resource.new(organization_url(organization_id), @configuration.rest_client_options).get(headers)
+      end
+      OrganizationRepresentation.from_hash(JSON.parse(response))
+    end
+
+    def identity_providers(organization_id)
+      response = execute_http do
+        RestClient::Resource.new(identity_providers_url(organization_id), @configuration.rest_client_options).get(headers)
+      end
+      JSON.parse(response).map { |idp_as_hash| IdentityProviderRepresentation.from_hash(idp_as_hash) }
+    end
+
+    def get_identity_provider(organization_id, identity_provider_alias)
+      raise ArgumentError.new("identity_provider_alias must be defined") if identity_provider_alias.nil?
+      response = execute_http do
+        RestClient::Resource.new("#{identity_providers_url(organization_id)}/#{identity_provider_alias}", @configuration.rest_client_options).get(headers)
+      end
+      IdentityProviderRepresentation.from_hash(JSON.parse(response))
+    end
+
+    def add_identity_provider(organization_id, identity_provider_alias)
+      raise ArgumentError.new("identity_provider_alias must be defined") if identity_provider_alias.nil?
+      execute_http do
+        RestClient::Resource.new(identity_providers_url(organization_id), @configuration.rest_client_options).post(identity_provider_alias, headers)
+      end
+      true
+    end
+
+    def delete_identity_provider(organization_id, identity_provider_alias)
+      execute_http do
+        RestClient::Resource.new(identity_provider_url(organization_id, identity_provider_alias), @configuration.rest_client_options).delete(headers)
+      end
+      true
+    end
+
+    def members_count(organization_id)
+      response = execute_http do
+        RestClient::Resource.new(members_count_url(organization_id), @configuration.rest_client_options).get(headers)
+      end
+      response.to_i
+    end
+
+    def members(organization_id, exact=nil, first=nil, max=nil, membership_type=nil, search=nil)
+      response = execute_http do
+        RestClient::Resource.new(members_url_with_query_parameters(organization_id, exact, first, max, membership_type, search), @configuration.rest_client_options).get(headers)
+      end
+      JSON.parse(response).map { |member_as_hash| MemberRepresentation.from_hash(member_as_hash) }
+    end
+
+    def invite_existing_user(organization_id, user_id)
+      raise ArgumentError.new("user_id must be defined") if user_id.nil?
+      execute_http do
+        RestClient::Resource.new(invite_existing_user_url(organization_id), @configuration.rest_client_options).post({id: user_id}, headers.merge(content_type: "application/x-www-form-urlencoded"))
+      end
+      true
+    end
+
+    def invite_user(organization_id, email, first_name, last_name)
+      execute_http do
+        RestClient::Resource.new(invite_user_url(organization_id), @configuration.rest_client_options).post({
+          email: email,
+          firstName: first_name,
+          lastName: last_name
+        }, headers.merge(content_type: "application/x-www-form-urlencoded"))
+      end
+      true
+    end
+
+    def add_member(organization_id, user_id)
+      raise ArgumentError.new("user_id must be defined") if user_id.nil?
+      execute_http do
+        RestClient::Resource.new(members_url(organization_id), @configuration.rest_client_options).post(user_id, headers)
+      end
+      true
+    end
+
+    def delete_member(organization_id, member_id)
+      execute_http do
+        RestClient::Resource.new(member_url(organization_id, member_id), @configuration.rest_client_options).delete(headers)
+      end
+      true
+    end
+
+    def get_member(organization_id, member_id)
+      response = execute_http do
+        RestClient::Resource.new(member_url(organization_id, member_id), @configuration.rest_client_options).get(headers)
+      end
+      MemberRepresentation.from_hash(JSON.parse(response))
+    end
+
+    def associated_with_member(member_id, brief_representation=true)
+      response = execute_http do
+        RestClient::Resource.new(associated_with_member_url(member_id, brief_representation), @configuration.rest_client_options).get(headers)
+      end
+      JSON.parse(response).map { |organization_as_hash| OrganizationRepresentation.from_hash(organization_as_hash) }
+    end
+
+    def organizations_url
+      "#{@realm_client.realm_admin_url}/organizations"
+    end
+
+    def organization_url(organization_id)
+      raise ArgumentError.new("organization_id must be defined") if organization_id.nil?
+      "#{organizations_url}/#{organization_id}"
+    end
+
+    def identity_providers_url(organization_id)
+      "#{organization_url(organization_id)}/identity-providers"
+    end
+
+    def identity_provider_url(organization_id, identity_provider_alias)
+      raise ArgumentError.new("identity_provider_alias must be defined") if identity_provider_alias.nil?
+      "#{identity_providers_url(organization_id)}/#{identity_provider_alias}"
+    end
+
+    def count_url(exact, query, search)
+      query_parameters = {exact: exact, q: query, search: search}.compact.to_a.map { |e| "#{e[0]}=#{e[1]}" }.join("&")
+      "#{organizations_url}/count?#{query_parameters}"
+    end
+
+    def organizations_url_with_parameters(brief_representation, exact, first, max, query, search)
+      query_parameters = {
+        briefRepresentation: brief_representation,
+        exact: exact,
+        first: first,
+        max: max,
+        q: query,
+        search: search
+      }.compact.to_a.map { |e| "#{e[0]}=#{e[1]}" }.join("&")
+      "#{organizations_url}?#{query_parameters}"
+    end
+
+    def associated_with_member_url(member_id, brief_representation=true)
+      "#{organizations_url}/members/#{member_id}/organizations?briefRepresentation=#{brief_representation}"
+    end
+
+    def members_count_url(organization_id)
+      "#{organization_url(organization_id)}/members/count"
+    end
+
+    def member_url(organization_id, member_id)
+      raise ArgumentError.new("member_id must be defined") if member_id.nil?
+      "#{organization_url(organization_id)}/members/#{member_id}"
+    end
+
+    def invite_existing_user_url(organization_id)
+      "#{organization_url(organization_id)}/members/invite-existing-user"
+    end
+
+    def invite_user_url(organization_id)
+      "#{organization_url(organization_id)}/members/invite-user"
+    end
+
+    def members_url(organization_id)
+      "#{organization_url(organization_id)}/members"
+    end
+
+    def members_url_with_query_parameters(organization_id, exact, first, max, membership_type, search)
+      query_parameters = {
+        exact: exact,
+        first: first,
+        max: max,
+        membershipType: membership_type,
+        search: search
+      }.compact.to_a.map { |e| "#{e[0]}=#{e[1]}" }.join("&")
+      "#{organization_url(organization_id)}/members?#{query_parameters}"
+    end
+
+    def build(name, alias_name, enabled, description, redirect_url=nil, domains=[], attributes={})
+      unless domains.is_a?(Array)
+        raise ArgumentError.new("domains must be an Array, got #{new_domains.class}")
+      end
+
+      unless domains.all? { |domain| domain.is_a?(KeycloakAdmin::OrganizationDomainRepresentation) }
+        raise ArgumentError.new("All items in domains must be of type OrganizationDomainRepresentation")
+      end
+
+      organization              = OrganizationRepresentation.new
+      organization.name         = name
+      organization.alias        = alias_name
+      organization.enabled      = enabled
+      organization.description  = description
+      organization.redirect_url = redirect_url
+      organization.domains      = domains
+      organization.attributes   = attributes
+      organization
+    end
+  end
+end

data/lib/keycloak-admin/client/realm_client.rb

@@ -95,6 +95,10 @@ module KeycloakAdmin
       IdentityProviderClient.new(@configuration, self)
     end
 
+    def organizations
+      OrganizationClient.new(@configuration, self)
+    end
+
     def user(user_id)
       UserResource.new(@configuration, self, user_id)
     end

data/lib/keycloak-admin/representation/identity_provider_representation.rb

@@ -11,6 +11,7 @@ module KeycloakAdmin
                   :add_read_token_role_on_create,
                   :authenticate_by_default,
                   :link_only,
+                  :organization_id,
                   :first_broker_login_flow_alias,
                   :config
 
@@ -30,6 +31,7 @@ module KeycloakAdmin
           hash["addReadTokenRoleOnCreate"],
           hash["authenticateByDefault"],
           hash["linkOnly"],
+          hash["organizationId"],
           hash["firstBrokerLoginFlowAlias"],
           hash["config"]
         )
@@ -47,6 +49,7 @@ module KeycloakAdmin
                    add_read_token_role_on_create,
                    authenticate_by_default,
                    link_only,
+                   organization_id,
                    first_broker_login_flow_alias,
                    config)
       @alias                           = alias_name
@@ -60,6 +63,7 @@ module KeycloakAdmin
       @add_read_token_role_on_create   = add_read_token_role_on_create
       @authenticate_by_default         = authenticate_by_default
       @link_only                       = link_only
+      @organization_id                 = organization_id
       @first_broker_login_flow_alias   = first_broker_login_flow_alias
       @config                          = config || {}
     end

data/lib/keycloak-admin/representation/member_representation.rb

@@ -0,0 +1,11 @@
+module KeycloakAdmin
+  class MemberRepresentation < UserRepresentation
+    attr_accessor :membership_type
+
+    def self.from_hash(hash)
+      member                 = super(hash)
+      member.membership_type = hash["membershipType"]
+      member
+    end
+  end
+end

data/lib/keycloak-admin/representation/organization_domain_representation.rb

@@ -0,0 +1,18 @@
+module KeycloakAdmin
+  class OrganizationDomainRepresentation < Representation
+    attr_accessor :name, :verified
+
+    def initialize(name, verified)
+      @name     = name
+      @verified = verified
+    end
+
+    def self.from_hash(hash)
+      new(hash["name"], hash["verified"])
+    end
+  end
+end
+
+
+
+

data/lib/keycloak-admin/representation/organization_representation.rb

@@ -0,0 +1,30 @@
+module KeycloakAdmin
+  class OrganizationRepresentation < Representation
+    attr_accessor :id,
+      :name,
+      :alias,
+      :enabled,
+      :description,
+      :redirect_url,
+      :attributes,
+      :domains,
+      :members,
+      :attributes,
+      :identity_providers
+
+    def self.from_hash(hash)
+      role                    = new
+      role.id                 = hash["id"]
+      role.name               = hash["name"]
+      role.alias              = hash["alias"]
+      role.enabled            = hash["enabled"]
+      role.description        = hash["description"]
+      role.redirect_url       = hash["redirectUrl"]
+      role.attributes         = hash["attributes"] || {}
+      role.domains            = hash["domains"].nil? ? [] : hash["domains"].map { |domain| KeycloakAdmin::OrganizationDomainRepresentation.from_hash(domain) }
+      role.members            = hash["members"].nil? ? [] : hash["members"].map { |member| KeycloakAdmin::MemberRepresentation.from_hash(member) }
+      role.identity_providers = hash["identityProviders"].nil? ? [] : hash["identityProviders"].map { |provider| KeycloakAdmin::IdentityProviderRepresentation.from_hash(provider) }
+      role
+    end
+  end
+end

data/lib/keycloak-admin/version.rb

@@ -1,3 +1,3 @@
 module KeycloakAdmin
-  VERSION = "1.1.5"
+  VERSION = "1.1.6"
 end

data/lib/keycloak-admin.rb

@@ -7,6 +7,7 @@ require_relative "keycloak-admin/client/client_role_client"
 require_relative "keycloak-admin/client/client_role_mappings_client"
 require_relative "keycloak-admin/client/group_client"
 require_relative "keycloak-admin/client/realm_client"
+require_relative "keycloak-admin/client/organization_client"
 require_relative "keycloak-admin/client/role_client"
 require_relative "keycloak-admin/client/role_mapper_client"
 require_relative "keycloak-admin/client/token_client"
@@ -27,10 +28,13 @@ require_relative "keycloak-admin/representation/token_representation"
 require_relative "keycloak-admin/representation/impersonation_redirection_representation"
 require_relative "keycloak-admin/representation/impersonation_representation"
 require_relative "keycloak-admin/representation/credential_representation"
+require_relative "keycloak-admin/representation/organization_domain_representation"
+require_relative "keycloak-admin/representation/organization_representation"
 require_relative "keycloak-admin/representation/realm_representation"
 require_relative "keycloak-admin/representation/role_representation"
 require_relative "keycloak-admin/representation/federated_identity_representation"
 require_relative "keycloak-admin/representation/user_representation"
+require_relative "keycloak-admin/representation/member_representation"
 require_relative "keycloak-admin/representation/identity_provider_mapper_representation"
 require_relative "keycloak-admin/representation/identity_provider_representation"
 require_relative "keycloak-admin/representation/attack_detection_representation"

data/spec/client/organization_client_spec.rb

@@ -0,0 +1,595 @@
+RSpec.describe KeycloakAdmin::OrganizationClient do
+  describe "#organization_url" do
+    let(:realm_name)       { "valid-realm" }
+    let(:organization_id)  { nil }
+
+    before(:each) do
+      @built_url = KeycloakAdmin.realm(realm_name).organizations.organization_url(organization_id)
+    end
+
+    context "when organization_id is defined" do
+      let(:organization_id) { "95985b21-d884-4bbd-b852-cb8cd365afc2" }
+      it "return a proper url with the organization id" do
+        expect(@built_url).to eq "http://auth.service.io/auth/admin/realms/valid-realm/organizations/95985b21-d884-4bbd-b852-cb8cd365afc2"
+      end
+    end
+  end
+
+  describe "#list" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      json_payload = <<-'payload'
+        [
+          {
+            "id": "8f6e474e-e688-4bec-99ba-5dc862594f4b",
+            "name": "My organization",
+            "alias": "myorg",
+            "enabled": true,
+            "description": "A single organization",
+            "domains": [
+              {
+                "name": "hello.com",
+                "verified": false
+              },
+              {
+                "name": "gmail.com",
+                "verified": true
+              }
+            ]
+          }
+        ]
+      payload
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return json_payload
+    end
+
+    it "lists organizations" do
+      organizations = @organization_client.list
+      expect(organizations.length).to eq 1
+      expect(organizations[0].id).to eq "8f6e474e-e688-4bec-99ba-5dc862594f4b"
+      expect(organizations[0].name).to eq "My organization"
+    end
+
+    it "passes rest client options" do
+      rest_client_options = {timeout: 10}
+      allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:rest_client_options).and_return rest_client_options
+
+      expect(RestClient::Resource).to receive(:new).with(
+        "http://auth.service.io/auth/admin/realms/valid-realm/organizations?briefRepresentation=true", rest_client_options).and_call_original
+
+      organizations = @organization_client.list
+      expect(organizations.length).to eq 1
+      expect(organizations[0]).to be_a KeycloakAdmin::OrganizationRepresentation
+      expect(organizations[0].id).to eq "8f6e474e-e688-4bec-99ba-5dc862594f4b"
+      expect(organizations[0].name).to eq "My organization"
+    end
+  end
+
+  describe "#count" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      json_payload = "2"
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return json_payload
+    end
+
+    it "count organizations" do
+      count = @organization_client.count(false, nil, "test")
+      expect(count).to eq 2
+    end
+
+    context "when building the count url" do
+      let(:exact)  { nil }
+      let(:query)  { nil }
+      let(:search) { nil }
+
+      before(:each) do
+        @count_url = @organization_client.count_url(exact, query, search)
+      end
+
+      context "with everything null" do
+        it "return a proper url" do
+          expect(@count_url).to eq "http://auth.service.io/auth/admin/realms/valid-realm/organizations/count?"
+        end 
+      end
+
+      context "with exact=false" do
+        let(:exact)  { false }
+        it "return a proper url" do
+          expect(@count_url).to eq "http://auth.service.io/auth/admin/realms/valid-realm/organizations/count?exact=false"
+        end 
+      end
+
+      context "with exact=true" do
+        let(:exact)  { true }
+        it "return a proper url" do
+          expect(@count_url).to eq "http://auth.service.io/auth/admin/realms/valid-realm/organizations/count?exact=true"
+        end 
+      end
+
+      context "with query=test" do
+        let(:query)  { "test" }
+        it "return a proper url" do
+          expect(@count_url).to eq "http://auth.service.io/auth/admin/realms/valid-realm/organizations/count?q=test"
+        end 
+      end
+
+      context "with search=nameoforg" do
+        let(:search) { "nameoforg" }
+        it "return a proper url" do
+          expect(@count_url).to eq "http://auth.service.io/auth/admin/realms/valid-realm/organizations/count?search=nameoforg"
+        end 
+      end
+
+      context "with every argument setup" do
+        let(:exact)  { true }
+        let(:query)  { "a query" }
+        let(:search) { "a name" }
+        it "return a proper url" do
+          expect(@count_url).to eq "http://auth.service.io/auth/admin/realms/valid-realm/organizations/count?exact=true&q=a query&search=a name"
+        end 
+      end
+    end
+  end
+
+  describe "#associated_with_member" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      json_payload = <<-'payload'
+        [
+          {
+            "id": "8f6e474e-e688-4bec-99ba-5dc862594f4b",
+            "name": "My organization",
+            "alias": "myorg",
+            "enabled": true,
+            "description": "A single organization",
+            "domains": [
+              {
+                "name": "hello.com",
+                "verified": false
+              },
+              {
+                "name": "gmail.com",
+                "verified": true
+              }
+            ]
+          }
+        ]
+      payload
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return json_payload
+    end
+
+    it "list organizations of members organizations" do
+      organizations = @organization_client.associated_with_member("648ebe7f-e4ba-4d82-a87d-c585c866d0e7")
+      expect(organizations.size).to eq 1
+      expect(organizations[0]).to be_a KeycloakAdmin::OrganizationRepresentation
+      expect(organizations[0].id).to eq "8f6e474e-e688-4bec-99ba-5dc862594f4b"
+    end
+  end
+
+  describe "#delete" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:delete).and_return ""
+    end
+
+    it "deletes an organization" do
+      result = @organization_client.delete("2904e1a1-e5f4-4143-8725-003e54cc8b58")
+      expect(result).to be(true)
+    end
+
+    it "raises a delete error" do
+      rest_client_options = {timeout: 10}
+      allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:rest_client_options).and_return rest_client_options
+
+      expect(RestClient::Resource).to receive(:new).with(
+        "http://auth.service.io/auth/admin/realms/valid-realm/organizations/2904e1a1-e5f4-4143-8725-003e54cc8b58", rest_client_options).and_raise("error")
+
+      expect { @organization_client.delete("2904e1a1-e5f4-4143-8725-003e54cc8b58") }.to raise_error("error")
+    end
+  end
+
+  describe "#identity_providers" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      json_payload = <<-'payload'
+        [
+          {
+            "alias": "google",
+            "displayName": "",
+            "internalId": "59b28b03-07db-4281-b637-4040368df082",
+            "providerId": "google",
+            "enabled": true,
+            "updateProfileFirstLoginMode": "on",
+            "trustEmail": false,
+            "storeToken": false,
+            "addReadTokenRoleOnCreate": false,
+            "authenticateByDefault": false,
+            "linkOnly": false,
+            "hideOnLogin": true,
+            "organizationId": "8f6e474e-e688-4bec-99ba-5dc862594f4b",
+            "config": {
+              "syncMode": "LEGACY",
+              "clientSecret": "**********",
+              "clientId": "test",
+              "kc.org.broker.redirect.mode.email-matches": "false"
+            }
+          }
+        ]
+      payload
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return json_payload
+    end
+
+    it "get identity providers" do
+      identity_providers = @organization_client.identity_providers("8f6e474e-e688-4bec-99ba-5dc862594f4b")
+      expect(identity_providers.size).to eq 1
+      expect(identity_providers[0]).to be_a KeycloakAdmin::IdentityProviderRepresentation
+      expect(identity_providers[0].alias).to eq "google"
+      expect(identity_providers[0].organization_id).to eq "8f6e474e-e688-4bec-99ba-5dc862594f4b"
+    end
+  end
+
+  describe "#add_identity_provider" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:post).and_return ""
+    end
+
+    it "adds one identity provider" do
+      @organization_client.add_identity_provider("8f6e474e-e688-4bec-99ba-5dc862594f4b", "google")
+    end
+  end
+
+  describe "#get_identity_provider" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      json_payload = <<-'payload'
+        {
+          "alias": "google",
+          "displayName": "",
+          "internalId": "59b28b03-07db-4281-b637-4040368df082",
+          "providerId": "google",
+          "enabled": true,
+          "updateProfileFirstLoginMode": "on",
+          "trustEmail": false,
+          "storeToken": false,
+          "addReadTokenRoleOnCreate": false,
+          "authenticateByDefault": false,
+          "linkOnly": false,
+          "hideOnLogin": true,
+          "organizationId": "8f6e474e-e688-4bec-99ba-5dc862594f4b",
+          "config": {
+            "syncMode": "LEGACY",
+            "clientSecret": "**********",
+            "clientId": "test",
+            "kc.org.broker.redirect.mode.email-matches": "false"
+          }
+        }
+      payload
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return json_payload
+    end
+
+    it "get identity provider" do
+      idp = @organization_client.get_identity_provider("8f6e474e-e688-4bec-99ba-5dc862594f4b", "google")
+      expect(idp).to be_a KeycloakAdmin::IdentityProviderRepresentation
+      expect(idp.alias).to eq "google"
+    end
+  end
+
+  describe "#get" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      json_payload = <<-'payload'
+        {
+          "id": "8f6e474e-e688-4bec-99ba-5dc862594f4b",
+          "name": "My organization",
+          "alias": "myorg",
+          "enabled": true,
+          "description": "A single organization",
+          "domains": [
+            {
+              "name": "hello.com",
+              "verified": false
+            },
+            {
+              "name": "gmail.com",
+              "verified": true
+            }
+          ]
+        }
+      payload
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return json_payload
+    end
+
+    it "get organization" do
+      organization = @organization_client.get("8f6e474e-e688-4bec-99ba-5dc862594f4b")
+      expect(organization).to be
+      expect(organization).to be_a KeycloakAdmin::OrganizationRepresentation
+      expect(organization.id).to eq "8f6e474e-e688-4bec-99ba-5dc862594f4b"
+      expect(organization.name).to eq "My organization"
+    end
+
+    it "passes rest client options" do
+      rest_client_options = {timeout: 10}
+      allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:rest_client_options).and_return rest_client_options
+
+      expect(RestClient::Resource).to receive(:new).with(
+        "http://auth.service.io/auth/admin/realms/valid-realm/organizations/8f6e474e-e688-4bec-99ba-5dc862594f4b", rest_client_options).and_call_original
+
+      organization = @organization_client.get("8f6e474e-e688-4bec-99ba-5dc862594f4b")
+      expect(organization).to be
+      expect(organization).to be_a KeycloakAdmin::OrganizationRepresentation
+      expect(organization.id).to eq "8f6e474e-e688-4bec-99ba-5dc862594f4b"
+    end
+  end
+
+  describe "#members_count" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return "2"
+    end
+
+    it "get count of members" do
+      count = @organization_client.members_count("8f6e474e-e688-4bec-99ba-5dc862594f4b")
+      expect(count).to eq 2
+    end
+  end
+
+  describe "#members" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      json_payload = <<-'payload'
+        [
+          {
+              "id": "648ebe7f-e4ba-4d82-a87d-c585c866d0e7",
+              "username": "admin",
+              "emailVerified": false,
+              "attributes": {
+                  "is_temporary_admin": [
+                      "true"
+                  ]
+              },
+              "enabled": true,
+              "createdTimestamp": 1767600090489,
+              "totp": false,
+              "disableableCredentialTypes": [],
+              "requiredActions": [],
+              "notBefore": 0,
+              "membershipType": "UNMANAGED"
+          },
+          {
+              "id": "2167481a-6a08-44f3-aa9a-42e33afa6834",
+              "username": "client",
+              "emailVerified": true,
+              "enabled": true,
+              "createdTimestamp": 1767601626861,
+              "totp": false,
+              "disableableCredentialTypes": [],
+              "requiredActions": [],
+              "notBefore": 0,
+              "membershipType": "MANAGED"
+          }
+      ]
+      payload
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return json_payload
+    end
+
+    it "get members" do
+      members = @organization_client.members("8f6e474e-e688-4bec-99ba-5dc862594f4b")
+      expect(members.size).to eq 2
+      expect(members[0]).to be_a KeycloakAdmin::MemberRepresentation
+      expect(members[0].id).to eq "648ebe7f-e4ba-4d82-a87d-c585c866d0e7"
+      expect(members[0].membership_type).to eq "UNMANAGED"
+      expect(members[1]).to be_a KeycloakAdmin::MemberRepresentation
+      expect(members[1].id).to eq "2167481a-6a08-44f3-aa9a-42e33afa6834"
+      expect(members[1].membership_type).to eq "MANAGED"
+    end
+  end
+
+  describe "#invite_existing_user" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:post).and_return ""
+    end
+
+    it "invites an existing user" do
+      @organization_client.invite_existing_user("8f6e474e-e688-4bec-99ba-5dc862594f4b", "9a2ff47d-759c-4126-a281-8e4a7c6465e4")
+    end
+  end
+
+  describe "#invite_user" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:post).and_return ""
+    end
+
+    it "invites an existing user" do
+      @organization_client.invite_user("8f6e474e-e688-4bec-99ba-5dc862594f4b", "hello@acme.com", "John", "Doe")
+    end
+  end
+
+  describe "#delete_member" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:delete).and_return ""
+    end
+
+    it "deletes a member" do
+      result = @organization_client.delete_member("8f6e474e-e688-4bec-99ba-5dc862594f4b", "e226d9d3-868e-453b-9bfc-d9d9cc534526")
+      expect(result).to be(true)
+    end
+  end
+
+  describe "#get_member" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      json_payload = <<-'payload'
+        {
+          "id": "9a2ff47d-759c-4126-a281-8e4a7c6465e4",
+          "username": "hello",
+          "email": "hello@gmail.com",
+          "emailVerified": true,
+          "enabled": true,
+          "createdTimestamp": 1767608088024,
+          "totp": false,
+          "disableableCredentialTypes": [],
+          "requiredActions": [],
+          "notBefore": 0,
+          "membershipType": "UNMANAGED"
+        }  
+      payload
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return json_payload
+    end
+
+    it "gets a member" do
+      member = @organization_client.get_member("8f6e474e-e688-4bec-99ba-5dc862594f4b", "9a2ff47d-759c-4126-a281-8e4a7c6465e4")
+      expect(member).to be
+      expect(member).to be_a KeycloakAdmin::MemberRepresentation
+      expect(member.id).to eq "9a2ff47d-759c-4126-a281-8e4a7c6465e4"
+      expect(member.membership_type).to eq "UNMANAGED"
+    end
+  end
+
+  describe "#add_member" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:post).and_return ""
+    end
+
+    it "creates a member from an existing user" do
+      result = @organization_client.add_member("8f6e474e-e688-4bec-99ba-5dc862594f4b", "9a2ff47d-759c-4126-a281-8e4a7c6465e4")
+      expect(result).to be true
+    end
+  end
+
+  describe "#add_member" do
+    let(:realm_name) { "valid-realm" }
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:post).and_return ""
+    end
+
+    it "creates a member from an existing user" do
+      result = @organization_client.add_member("8f6e474e-e688-4bec-99ba-5dc862594f4b", "9a2ff47d-759c-4126-a281-8e4a7c6465e4")
+      expect(result).to be true
+    end
+  end
+
+  describe "#update" do
+    let(:realm_name) { "valid-realm" }
+    let(:json_payload) do
+      <<-'payload'
+        {
+          "id": "8f6e474e-e688-4bec-99ba-5dc862594f4b",
+          "name": "Company",
+          "alias": "company",
+          "enabled": true,
+          "description": "A test organization",
+          "redirectUrl": "https://myapp.acme.com/redirect",
+          "attributes": {
+              "hello": [
+                  "yes"
+              ]
+          },
+          "domains": [
+              {
+                  "name": "hello.com",
+                  "verified": false
+              },
+              {
+                  "name": "help.com",
+                  "verified": false
+              }
+          ]
+      }  
+      payload
+    end
+
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:put).and_return ""
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return json_payload
+    end
+
+    it "updates an organization" do
+      organization         = KeycloakAdmin::OrganizationRepresentation.from_json(json_payload)
+      updated_organization = @organization_client.update(organization)
+      expect(updated_organization).to be
+      expect(updated_organization).to be_a KeycloakAdmin::OrganizationRepresentation
+      expect(updated_organization.id).to eq "8f6e474e-e688-4bec-99ba-5dc862594f4b"
+    end
+  end
+
+  describe "#create!" do
+    let(:realm_name) { "valid-realm" }
+    before(:each) do
+      @organization_client = KeycloakAdmin.realm(realm_name).organizations
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:post).and_return ""
+    end
+
+    it "creates an organization" do
+      @organization_client.create!(
+        "new name",
+        "alias_name",
+        "enabled",
+        "description",
+        "http://redirect_url",
+        [
+          KeycloakAdmin::OrganizationDomainRepresentation.new("acme.com", true),
+          KeycloakAdmin::OrganizationDomainRepresentation.new("doe.com", false)
+        ],
+        {
+          "advanced": ["yes", "no"],
+          "hello": ["maybe"]
+        }
+      )
+    end
+  end
+end

data/spec/representation/organization_representation_spec.rb

@@ -0,0 +1,64 @@
+
+RSpec.describe KeycloakAdmin::OrganizationRepresentation do
+  describe ".from_json" do
+    it "parse a single organization" do
+      json_payload = <<-'payload'
+        {
+          "id": "8f6e474e-e688-4bec-99ba-5dc862594f4b",
+          "name": "My organization",
+          "alias": "myorg",
+          "enabled": true,
+          "description": "A single organization",
+          "redirectUrl": "https://myapp.acme.com",
+          "attributes": {
+              "advanced": [
+                  "yes"
+              ],
+              "days": [
+                "monday",
+                "friday"
+              ]
+          },
+          "domains": [
+            {
+              "name": "hello.com",
+              "verified": false
+            },
+            {
+              "name": "gmail.com",
+              "verified": true
+            }
+          ]
+        }
+      payload
+
+      organization = described_class.from_json(json_payload)
+      expect(organization).to be
+      expect(organization).to be_a described_class
+      expect(organization.id).to eq "8f6e474e-e688-4bec-99ba-5dc862594f4b"
+      expect(organization.name).to eq "My organization"
+      expect(organization.alias).to eq "myorg"
+      expect(organization.description).to eq "A single organization"
+      expect(organization.redirect_url).to eq "https://myapp.acme.com"
+      expect(organization.enabled).to be true
+      
+      expect(organization.domains.size).to eq 2
+      expect(organization.domains[0]).to be_a KeycloakAdmin::OrganizationDomainRepresentation
+      expect(organization.domains[0].name).to eq "hello.com"
+      expect(organization.domains[0].verified).to be false
+      expect(organization.domains[1]).to be_a KeycloakAdmin::OrganizationDomainRepresentation
+      expect(organization.domains[1].name).to eq "gmail.com"
+      expect(organization.domains[1].verified).to be true
+
+      expect(organization.attributes.size).to eq 2
+      expect(organization.attributes["advanced"].size).to eq 1
+      expect(organization.attributes["advanced"][0]).to eq "yes"
+      expect(organization.attributes["days"].size).to eq 2
+      expect(organization.attributes["days"][0]).to eq "monday"
+      expect(organization.attributes["days"][1]).to eq "friday"
+
+      expect(organization.members.size).to eq 0
+      expect(organization.identity_providers.size).to eq 0
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: keycloak-admin
 version: !ruby/object:Gem::Version
-  version: 1.1.5
+  version: 1.1.6
 platform: ruby
 authors:
 - Lorent Lempereur
@@ -104,6 +104,7 @@ files:
 - lib/keycloak-admin/client/configurable_token_client.rb
 - lib/keycloak-admin/client/group_client.rb
 - lib/keycloak-admin/client/identity_provider_client.rb
+- lib/keycloak-admin/client/organization_client.rb
 - lib/keycloak-admin/client/realm_client.rb
 - lib/keycloak-admin/client/role_client.rb
 - lib/keycloak-admin/client/role_mapper_client.rb
@@ -125,6 +126,9 @@ files:
 - lib/keycloak-admin/representation/identity_provider_representation.rb
 - lib/keycloak-admin/representation/impersonation_redirection_representation.rb
 - lib/keycloak-admin/representation/impersonation_representation.rb
+- lib/keycloak-admin/representation/member_representation.rb
+- lib/keycloak-admin/representation/organization_domain_representation.rb
+- lib/keycloak-admin/representation/organization_representation.rb
 - lib/keycloak-admin/representation/protocol_mapper_representation.rb
 - lib/keycloak-admin/representation/realm_representation.rb
 - lib/keycloak-admin/representation/representation.rb
@@ -147,6 +151,7 @@ files:
 - spec/client/configurable_token_client_spec.rb
 - spec/client/group_client_spec.rb
 - spec/client/identity_provider_client_spec.rb
+- spec/client/organization_client_spec.rb
 - spec/client/realm_client_spec.rb
 - spec/client/role_client_spec.rb
 - spec/client/role_mapper_client_spec.rb
@@ -165,6 +170,7 @@ files:
 - spec/representation/identity_provider_mapper_representation_spec.rb
 - spec/representation/identity_provider_representation_spec.rb
 - spec/representation/impersonation_representation_spec.rb
+- spec/representation/organization_representation_spec.rb
 - spec/representation/protocol_mapper_representation_spec.rb
 - spec/representation/role_representation_spec.rb
 - spec/representation/session_representation_spec.rb