new user associated to an org, but not in the same domain name

[jmergy]

Just noting this. I just created a user and associated with a PDC organization now in the updated consideration of organizations and potential auth brokering. But, the user domain name is not of the domain of the organization I associated it to.

So, john@abc.com is the user and they are working with foo.com. We want them to be connected to foo.com and it's not a concern around auth brokering because foo.com does not have an association with an IdP, but still wanted to give a heads-up on the instance. I think this could be quite common - essentially someone working for an organization but not OF the organization from a domain name perspective.

[bickelj]

@jmergy Noted. Yes, I think this can and will happen many more times.

I looked in the PDC Keycloak instance and it looks like all is well: the user has domain abc.com and is also a member of an organization associated with foo.com, as it were. The organization foo.com in this case does not have a non-PDC IdP so all users need to be added to the organization.

In the case where an organization has a non-PDC IdP linked, only those users that log in with the associated domain will have some magic happen. And that does not prevent some other user with a different domain name from being added to that org.