keycloak/keycloak

OrganizationProvider.addManagedMember still adds member as unmanaged

Open

#43,094 opened on Sep 30, 2025

View on GitHub
 (3 comments) (3 reactions) (0 assignees)Java (8,346 forks)batch import
area/organizationshelp wantedkind/bugpriority/normalstatus/auto-bumpteam/core-iam

Repository metrics

Stars
 (34,398 stars)
PR merge metrics
 (Avg merge 6d 19h) (384 merged PRs in 30d)

Description

Before reporting an issue

  • I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

core

Describe the bug

When using OrganizationProvider.addManagedMember to add a user to an organization as a managed member, the user is still marked as unmanaged.

Going through the source code, I notice there is a default method in UserModel that drops the MembershipMetadata parameter.

    default void joinGroup(GroupModel group, MembershipMetadata metadata) {
        joinGroup(group);
    }

And the eventual joinGroup implementation is then using unmanaged as default.

Version

26.4.0

Regression

  • The issue is a regression

Expected behavior

When calling the OrganizationProvider.addManagedMember method, the user should be added as a managed member to the organization.

Actual behavior

When calling the OrganizationProvider.addManagedMember method, the user is added as an unmanaged member to the organization.

How to Reproduce?

Create a AdminRealmResourceProvider with a resource path that calls this method.

Anything else?

No response

Contributor guide

Research direction
Inspect the OrganizationProvider.addManagedMember method and trace the call to UserModel.joinGroup. The default method in UserModel drops the MembershipMetadata, causing joinGroup to use unmanaged default. Look for where joinGroup(GroupModel, MembershipMetadata) is implemented.
Tech stack
java
Domain
backendauthenticationauthorization
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaKeycloak internals
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70