New partner organisations (clinics, practices) are onboarded into the Keycloak partners realm. Each partner gets:
org_slug attributeorg_id user attribute (mapped to the JWT org_id claim)The org_id claim flows in every JWT issued to users in the partners realm,
allowing downstream services (AES Portal, etc.) to identify which organisation a
user belongs to.
/opt/onboard-partner.shA single command to create everything needed:
# Create a new partner
/opt/onboard-partner.sh \
-s oak-practice \
-n "Oak Practice" \
-u admin.oak \
-e admin@oak-practice.example
# List current partners
/opt/onboard-partner.sh --list
# Delete a partner (removes group & memberships)
/opt/onboard-partner.sh --delete oak-practice
| Option | Required | Description |
|---|---|---|
-s, --slug |
Yes | Organisation slug (e.g. oak-practice) |
-n, --name |
Yes | Display name (e.g. "Oak Practice") |
-u, --username |
Yes | Admin username |
-e, --email |
Yes | Admin email |
-p, --password |
No | Set password explicitly (default: auto-generated) |
-l, --list |
— | List all partner org groups |
-d, --delete |
— | Delete a partner org group |
Authenticates to the Keycloak Admin API and:
<slug> with attribute org_slug = ["<slug>"]org_id = ["<slug>"] attribute and a password================================================
PARTNER ONBOARDED SUCCESSFULLY
================================================
Organisation: Oak Practice
Slug: oak-practice
Admin user: admin.oak
Email: admin@oak-practice.example
Password: 7Xk2mR9vLp4qWz1A
------------------------------------------------
Console: https://auth.veripath.co.uk/admin/master/console/#/partners
Account: https://auth.veripath.co.uk/realms/partners/account/
================================================
If you prefer to onboard manually:
oak-practice)org_slug = oak-practiceorg_id = oak-practiceorg_id must be declared in Realm Settings → User Profile before it can be set as a user attribute (this was done during initial setup).| Item | Detail |
|---|---|
| Realm | partners |
User attribute org_id |
Declared in user profile, editable by admins only |
| Protocol mapper | org-id-mapper on profile scope → maps org_id user attribute to JWT org_id claim |
| Test client | aes-test-client (public, password grant) for API testing |
| Username | Org | Group | Status |
|---|---|---|---|
jane.smith / test123 |
Maple Surgery | maple-surgery |
Active |
john.doe / test123 |
Oak Practice | oak-practice |
Active |
org_id flows to appsUser logs in → Keycloak issues JWT with org_id claim
→ JWT sent to AES Portal (or downstream service)
→ Service reads org_id from JWT to scope data
For service accounts (machine-to-machine), the org_id is passed in the request
body when calling /api/sign — the booking app knows the org context from its
own tenancy module.
Delete a partner group and clean up user memberships:
/opt/onboard-partner.sh --delete oak-practice
To reset a user's password, use the admin console or:
/opt/kcadmin.sh set-password -r partners \
--username admin.oak --new-password "NewPass123"