pedroigor · Sep 23, 2026 · Sep 21, 2026
@@ -143,6 +143,7 @@ public Response handleToken(InviteOrgActionToken token, ActionTokenContext<Invit
         }
 
         if (organization.isMember(user)) {
+            session.getContext().setOrganization(organization);
             return alreadyMemberResponse(organization, user, tokenContext, token);
         }
 
@@ -153,6 +154,8 @@ public Response handleToken(InviteOrgActionToken token, ActionTokenContext<Invit
             return invalidTokenResponse(tokenContext, token);
         }
 
+        session.getContext().setOrganization(organization);
+
         UriInfo uriInfo = tokenContext.getUriInfo();
         RealmModel realm = tokenContext.getRealm();
 

@@ -672,6 +672,11 @@
         return this;
     }
 
+    public RealmBuilder loginTheme(String loginTheme) {
+        rep.setLoginTheme(loginTheme);
+        return this;
+    }
+
     public RealmBuilder permanentLockout(boolean permanentLockout) {
         rep.setPermanentLockout(permanentLockout);
         return this;
@@ -696,7 +701,7 @@
     * @return this
     * @deprecated
     */
    public RealmBuilder update(RealmUpdate... update) {
        Arrays.stream(update).forEach(u -> u.update(rep));
        return this;
    }

@@ -0,0 +1,109 @@
+/*
+ * Copyright 2026 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.organization.admin;
+
+import java.io.IOException;
+
+import jakarta.mail.internet.MimeMessage;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+
+import org.keycloak.admin.client.resource.OrganizationResource;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.mail.MailServer;
+import org.keycloak.testframework.mail.annotations.InjectMailServer;
+import org.keycloak.testframework.realm.UserBuilder;
+import org.keycloak.testframework.ui.annotations.InjectPage;
+import org.keycloak.testframework.ui.annotations.InjectWebDriver;
+import org.keycloak.testframework.ui.page.InfoPage;
+import org.keycloak.testframework.ui.webdriver.ManagedWebDriver;
+import org.keycloak.testframework.util.ApiUtil;
+import org.keycloak.tests.common.CustomProvidersServerConfig;
+import org.keycloak.tests.utils.MailUtils;
+
+import org.junit.jupiter.api.Test;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.not;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@KeycloakIntegrationTest(config = CustomProvidersServerConfig.class)
+public class OrganizationInvitationThemeTest extends AbstractOrganizationTest {
+
+    // the domain must not match the organization domain, otherwise the organization resolves from the email
+    // address alone and the test no longer tells us anything about the invitation
+    private static final String INVITEE_EMAIL = "invited@myemail.com";
+
+    @InjectMailServer
+    MailServer mailServer;
+
+    @InjectWebDriver
+    ManagedWebDriver driver;
+
+    @InjectPage
+    InfoPage infoPage;
+
+    @Test
+    public void testOrganizationAvailableWhenConfirmingMembership() throws IOException {
+        realm.updateWithCleanup(r -> r.loginTheme("organization"));
+        OrganizationResource organization = realm.admin().organizations().get(createOrganization().getId());
+        String userId = createUser(INVITEE_EMAIL);
+
+        organization.members().inviteExistingUser(userId).close();
+        driver.open(getInvitationLink());
+        infoPage.assertCurrent();
+
+        // the invitee is not a member yet, but the page still knows the organization they were invited to
+        String page = driver.page().getPageSource();
+        assertThat(page, containsString("Sign-in to " + organizationName + " organization"));
+        assertThat(page, containsString("The key is value1, value2"));
+        assertThat(page, not(containsString("User is member of")));
+    }
+
+    private String createUser(String email) {
+        UserRepresentation user = UserBuilder.create()
+                .username(email)
+                .email(email)
+                .name("Invited", "User")
+                .emailVerified(true)
+                .build();
+        String userId;
+
+        try (Response response = realm.admin().users().create(user)) {
+            userId = ApiUtil.getCreatedId(response);
+        }
+
+        realm.cleanup().add(r -> {
+            try {
+                r.users().get(userId).remove();
+            } catch (NotFoundException ignored) {
+            }
+        });
+        return userId;
+    }
+
+    private String getInvitationLink() throws IOException {
+        assertTrue(mailServer.waitForIncomingEmail(10_000, 1), "invitation email not received");
+
+        MimeMessage message = mailServer.getLastReceivedMessage();
+        assertNotNull(message);
+        return MailUtils.getLink(MailUtils.getBody(message).getHtml()).trim();
+    }
+}
@@ -5,6 +5,12 @@
       "types": [
         "account"
       ]
+    },
+    {
+      "name": "organization",
+      "types": [
+        "login"
+      ]
     }
   ]
 }
@@ -0,0 +1,28 @@
+<#import "template.ftl" as layout>
+<@layout.registrationLayout displayMessage=false; section>
+    <#if section = "header">
+        <#if messageHeader??>
+            ${kcSanitize(msg("${messageHeader}"))?no_esc}
+        <#else>
+            ${message.summary}
+        </#if>
+    <#elseif section = "form">
+    <div id="kc-info-message">
+        <#if org??>
+            Sign-in to ${org.name} organization
+            <#list org.attributes?keys as key>
+                The ${key} is ${org.attributes[key]?join(", ")}
+            </#list>
+            <#if org.member>
+                User is member of ${org.name}
+            </#if>
+        <#else>
+            Sign-in to the realm
+        </#if>
+        <p class="instruction">${kcSanitize(message.summary)?no_esc}</p>
+        <#if actionUri?has_content>
+            <p><a href="${actionUri}">${msg("proceedWithAction")}</a></p>
+        </#if>
+    </div>
+    </#if>
+</@layout.registrationLayout>
@@ -0,0 +1 @@
+parent=keycloak