Grant access to an organization or a project in Keycloak

1. In the admin console, switch to the unity realm.
2. Perform one of these actions:
   • For a user, open the user properties and select the Role Mapping tab.
   • For a service account, open the client properties and select the Service Account Roles tab.
3. Select Assign role.
4. If the first filter is set to

   Filter by realm roles

   , then change it to

   Filter by clients

   .
5. Select the required role from the list, and then select Assign. Alternatively, use the filter

   Search by role name

   . If the required role doesn't exist, create it first in the organization properties.
   • To grant read-only access, choose the User type.
   • To grant full access, choose the Owner user type. Owners have access to the client that represents the organization, users and service accounts.
   All users must have at least a user type at the organization level.
   Note

   Keycloak automatically assigns the User type to SSO users for the default organization. This user type has this name:

   organization.39943160-54da-49ac-b1c7-bf26adc65855

   .

• Create an organization in Keycloak
• User roles:
  • RBAC reference for Unity Virtual Private Cloud
  • User types, roles, and permissions
  • Add-on user roles in Asset Manager