No Way to Invite Existing Users to a Different Organization (Authentik) #1159

New Issue

MrUnknownDE · 2026-04-05T18:22:56+02:00

MrUnknownDE commented

2026-04-05 18:22:56 +02:00

Originally created by @aungzm on 7/29/2025

I've set everything up under my server admin account, including the domain, resources, and the primary organization. I also configured OAuth with Authentik, using an account I'll refer to as admin1.

After logging in with the Authentik user (admin1), I was prompted to create an organization. I created a temporary organization called "ABC", assuming that my server admin account would later be able to invite admin1 into the original organization. However, I discovered that there doesn't seem to be any way to invite an existing user to a different organization.

I then deleted the admin1 account, forgetting to delete the "ABC" organization first and found out that when the server admin tries to create an organization with the same name ("ABC"), it reports that the organization already exists. It also appears that server admins cannot view or manage organizations created by other users.

This means that once a user account is deleted without cleaning up their organizations, those organizations remain in the system with no way to access, manage, or remove them effectively becoming orphaned or "phantom" entries in the database.

Here are a few ways this could be fixed:

Allow server admins to view and manage all organizations, including those created by other users.
Enable server admins to delete any organization, regardless of who created it.
Allow reassigning orphaned organizations (i.e., those whose creator accounts have been deleted) to another admin or user.
Support inviting existing users to other organizations with approval.
Warn or prompt when deleting a user who owns organizations to clean up or transfer ownership first.

*Originally created by @aungzm on 7/29/2025* I've set everything up under my server admin account, including the domain, resources, and the primary organization. I also configured OAuth with Authentik, using an account I'll refer to as admin1. After logging in with the Authentik user (admin1), I was prompted to create an organization. I created a temporary organization called "ABC", assuming that my server admin account would later be able to invite admin1 into the original organization. However, I discovered that there doesn't seem to be any way to invite an existing user to a different organization. I then deleted the admin1 account, forgetting to delete the "ABC" organization first and found out that when the server admin tries to create an organization with the same name ("ABC"), it reports that the organization already exists. It also appears that server admins cannot view or manage organizations created by other users. This means that once a user account is deleted without cleaning up their organizations, those organizations remain in the system with no way to access, manage, or remove them effectively becoming orphaned or "phantom" entries in the database. Here are a few ways this could be fixed: 1. Allow server admins to view and manage all organizations, including those created by other users. 2. Enable server admins to delete any organization, regardless of who created it. 3. Allow reassigning orphaned organizations (i.e., those whose creator accounts have been deleted) to another admin or user. 4. Support inviting existing users to other organizations with approval. 5. Warn or prompt when deleting a user who owns organizations to clean up or transfer ownership first.

MrUnknownDE closed this issue

2026-04-05 18:22:56 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label authentication authentication authentication needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1159