We are using Keycloak’s Organizations feature, where users can belong to multiple organizations and authenticate via each organization’s IdP. The current behavior we see is:
-
When a user logs in and links their account to an organization’s IdP, that link persists.
-
After logging out and attempting to switch to another organization, the option to log in with the new organization’s IdP is no longer available. Keycloak seems to prioritize the previously linked IdP.
Question:
Is this behavior by design? If so, what is the recommended approach to allow users to re-select a different organization’s IdP after they have already linked their account?
Any guidance or best practices would be appreciated!