User Attribute not inherited from organization attributes

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

organizations

Describe the bug

Attributes from organization are not inherited by user as group attributes are.

I would like to configure a conditional authenticator flow, when a user attribute is set, and I would like to set this attribute on organization, to have it inherited by all users of this organization.

Version

26.0.0

Regression

• The issue is a regression

Expected behavior

When using ConditionalUserAttributeValue authenticator, attributes sets on Organization should be resolved.

Actual behavior

attributes sets on Organization are ignored

How to Reproduce?

• Create an authentication flow with Condition - user attribute

• Add this attribute on the organization

• Create a user in this organization and login

==> conditional authenticator always returns false

Anything else?

ConditionalUserAttributeValue is using KeycloakModelUtils#resolveAttribute(org.keycloak.models.UserModel, java.lang.String, boolean) to resolve user attribute. Then, this method fetches all groups the user belongs to with user.getGroupsStream().

But UserAdapter#getGroupsStream is filtering only REALM groups : return result.filter(g -> Type.REALM.equals(g.getType())).sorted(Comparator.comparing(GroupModel::getName));

So ORGANIZATION groups are not returned and attribute from them are not resolved.

Perhaps we should have a method user.getAllGroupsStream() for this case wich do not filter anything ?

if this bug is validated, I am open to send a PR.