Remember me does not work when organization scope is enabled on login session.

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

authentication

Describe the bug

When a user login using the keycloak-js client with the organization scope added and he decide to click the remember me button. The remember me tag from the authorization is ignored by the OrganizationAuthenticator and silently dropped from the authentication session. It then gets cleaned up by AbstractUsernameFormAuthenticator because rememberMe is not sent to it.

Version

nightly (originally on 26.5.3, test done locally with main branch)

Regression

• The issue is a regression

Expected behavior

The person will see "Hello, ${name}! You are authenticated. Your organization is ${organizationName}." on the page The user will receive a remember me cookie being set.

Actual behavior

The person will see "You are not authenticated. Please log in."

How to Reproduce?

1. Front-end : Clone the sample front-end from here : Esurnir/keycloak-org-remberme-repro run npm install npm run dev to start frontend.
2. Keycloak backend (to match the /src/keycloak.ts settings) : Start a keycloak instance on port 8080. Create a realm named realm-with-orgs in keycloak (you can use the realm export json from the frontend to skip everything up to Create a user in keycloak). Enable Organization on the realm. Enable Add organization Id to the organization client scope mapper. Enable Remember me. Create a public client with standard-flow enabled named public-client. authorizing redirect to http://localhost:5173/* and origin http://localhost:5173 Create a user in keycloak. Create two organization in keycloak. Attach the user inside the two organization.

The test sequence:

1. Connect to http://localhost:5173 on a fresh session.
2. Click the login button
3. Enter your username and click remember me.
4. Select an organization
5. Close the browser entirely (or clear the session cookies).
6. Reopen the browser on http://localhost:5173 <Expected/VsActual case here>

Anything else?

Because of the organization scope OrganizationAuthenticator is the handler setting the notes for the first request and need to handle the remember me note.