Skip to main content
clerk-enterprise-rbac Configure enterprise SSO, role-based access control, and organization management.
Use when implementing SSO integration, configuring role-based permissions,
or setting up organization-level controls.
Trigger with phrases like "clerk SSO", "clerk RBAC",
"clerk enterprise", "clerk roles", "clerk permissions", "clerk organizations".
Aller à l'installation Skills Marketplace Découvrez et explorez les compétences IA créées par la communauté.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Afficher les détails du prompt Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/jeremylongshore/claude-code-plugins-plus-skills --skill clerk-enterprise-rbacLa commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Télécharger Zip Téléchargement... Métiers associés SOC
Basé sur la classification professionnelle SOC
Plus depuis ce dépôt Implement user sign-up and sign-in flows with Clerk.
Use when building authentication UI, customizing sign-in experience,
or implementing OAuth social login.
Trigger with phrases like "clerk sign-in", "clerk sign-up",
"clerk login flow", "clerk OAuth", "clerk social login".
Implement session management and middleware with Clerk.
Use when managing user sessions, configuring route protection,
or implementing token refresh and custom JWT templates.
Trigger with phrases like "clerk session", "clerk middleware",
"clerk route protection", "clerk token", "clerk JWT".
Create your first authenticated request with Clerk.
Use when making initial API calls, testing authentication,
or verifying Clerk integration works correctly.
Trigger with phrases like "clerk hello world", "first clerk request",
"test clerk auth", "verify clerk setup".
Explorateur de fichiers
2 fichiers name clerk-enterprise-rbac description Configure enterprise SSO, role-based access control, and organization management.
Use when implementing SSO integration, configuring role-based permissions,
or setting up organization-level controls.
Trigger with phrases like "clerk SSO", "clerk RBAC",
"clerk enterprise", "clerk roles", "clerk permissions", "clerk organizations".
allowed-tools Read, Write, Edit, Grep version 1.14.0 license MIT author Jeremy Longshore <jeremy@intentsolutions.io> tags ["saas","clerk","rbac","enterprise","organizations"] compatibility Designed for Claude Code, also compatible with Codex and OpenClaw
Clerk Enterprise RBAC
Overview
Implement enterprise-grade role-based access control, organization management, and SSO with Clerk. Covers custom roles and permissions, organization lifecycle, multi-tenant access patterns, SAML/OIDC SSO, and the Backend API for programmatic role management (released Nov 2025).
Prerequisites
Clerk Pro or Enterprise plan (Organizations + SSO require paid plan)
Organizations feature enabled in Clerk Dashboard > Organizations > Settings
Next.js 14+ with App Router (examples use @clerk/nextjs)
Instructions
Step 1: Enable Organizations and Add UI Components
import { OrganizationSwitcher , OrganizationProfile } from '@clerk/nextjs'
export default function OrgPage (return (
<div className ="p-8" >
<h1 > Select Organization</h1 >
<OrganizationSwitcher
hidePersonal ={false}
afterSelectOrganizationUrl ="/dashboard"
afterCreateOrganizationUrl ="/dashboard"
/>
<div className ="mt-8" >
<OrganizationProfile />
</div >
</div > Step 2: Define Custom Roles and Permissions
Configure in Clerk Dashboard > Organizations > Roles and
Permissions
Default roles (built-in):
Role Key Built-in Permissions Admin org:adminFull org management (members, settings, billing) Member org:memberView org, read-only access
Custom permissions (create in Dashboard > Organizations > Permissions):
Permission Key Description Read data org:data:readView organization resources Write data org:data:writeCreate/update resources Delete data org:data:deleteDelete resources Manage billing org:billing:manageAccess billing settings View analytics org:analytics:readAccess analytics dashboard
Custom roles (create in Dashboard > Organizations > Roles):
Role Permissions Use Case org:managerdata:read, data:write, analytics:readContent managers org:viewerdata:readRead-only stakeholders org:billing_admindata:read, billing:manageFinance team
Step 3: RBAC Middleware — Route Protection by Role
import { clerkMiddleware, createRouteMatcher } from '@clerk/nextjs/server'
const isPublicRoute = createRouteMatcher ([
'/' ,
'/sign-in(.*)' ,
'/sign-up(.*)' ,
'/api/webhooks(.*)' ,
])
const isAdminRoute = createRouteMatcher (['/admin(.*)' ])
const isManagerRoute = createRouteMatcher (['/manage(.*)' ])
export default clerkMiddleware (async (auth, req) => {
if (isPublicRoute (req)) return
if (isAdminRoute (req)) {
await auth.protect ({ role : 'org:admin' })
} else if (isManagerRoute (req)) {
await auth.protect ((has ) =>
has ({ role : 'org:admin' }) || has ({ role : 'org:manager' })
)
} else {
await auth.protect ()
}
})
Step 4: Permission Checks in Server Components
import { auth } from '@clerk/nextjs/server'
import { redirect } from 'next/navigation'
export default async function AdminPage (const { userId, orgId, orgRole, has } = await auth ()
if (!userId) redirect ('/sign-in' )
if (!orgId) redirect ('/org-selector' )
const canManageMembers = has ({ permission : 'org:sys_memberships:manage' })
const canWriteData = has ({ permission : 'org:data:write' })
const canDeleteData = has ({ permission : 'org:data:delete' })
const canViewAnalytics = has ({ permission : 'org:analytics:read' })
return (
<div >
<h1 > Admin Panel</h1 >
<p > Current role: {orgRole}</p >
<nav >
{canManageMembers && <a href ="/admin/members" > Manage Members</a > }
{canWriteData && <a href ="/admin/content" > Content Management</a > }
{canDeleteData && <a href ="/admin/danger-zone" > Danger Zone</a > }
{canViewAnalytics && <a href ="/admin/analytics" > Analytics</a > }
</nav >
</div >
Step 5: Permission Checks in Client Components 'use client'
import { Protect , useOrganization, useAuth } from '@clerk/nextjs'
export function AdminSection (const { organization } = useOrganization ()
const { has } = useAuth ()
return (
<div >
<h2 > {organization?.name}</h2 >
{/* Declarative: Protect component with fallback */}
<Protect
role ="org:admin"
fallback ={ <p > You need admin access to view this section.</p > }
>
<DangerZone />
</Protect >
{/* Permission-based rendering */}
<Protect permission ="org:data:write" >
<EditForm />
</Protect >
{/* Imperative: has() for conditional logic */}
{has?.({ permission: 'org:analytics:read' }) && (
<AnalyticsDashboard />
)}
</div >
Step 6: Organization Member Management via Backend API
import { auth, clerkClient } from '@clerk/nextjs/server'
export async function GET (const { orgId, has } = await auth ()
if (!orgId) return Response .json ({ error : 'No org selected' }, { status : 400 })
if (!has ({ permission : 'org:sys_memberships:read' })) {
return Response .json ({ error : 'Forbidden' }, { status : 403 })
}
const client = await clerkClient ()
const members = await client.organizations .getOrganizationMembershipList ({
organizationId : orgId,
})
return Response .json ({
members : members.data .map (m =>userId : m.publicUserData ?.userId ,
name : `${m.publicUserData?.firstName} ${m.publicUserData?.lastName} ` ,
email : m.publicUserData ?.identifier ,
role : m.role ,
joinedAt : m.createdAt ,
})),
})
}
export async function POST (req : Request const { orgId, userId, has } = await auth ()
if (!orgId || !has ({ permission : 'org:sys_memberships:manage' })) {
return Response .json ({ error : 'Forbidden' }, { status : 403 })
}
const { emailAddress, role } = await req.json ()
const client = await clerkClient ()
const invitation = await client.organizations .createOrganizationInvitation ({
organizationId : orgId,
emailAddress,
role : role || 'org:member' ,
inviterUserId : userId!,
})
return Response .json ({ invitation : { id : invitation.id , emailAddress, role } })
}
Step 7: Programmatic Role/Permission Management (Backend API)
import { clerkClient } from '@clerk/nextjs/server'
export async function createCustomRole (orgId : string const client = await clerkClient ()
await client.organizations .createOrganizationPermission ({
organizationId : orgId,
name : 'Manage reports' ,
key : 'org:reports:manage' ,
description : 'Create, edit, and delete reports' ,
})
await client.organizations .createOrganizationRole ({
organizationId : orgId,
name : 'Report Manager' ,
key : 'org:report_manager' ,
description : 'Can manage all reports' ,
permissions : ['org:reports:manage' , 'org:data:read' ],
})
}
export async function updateMemberRole (
orgId : string ,
userId : string ,
newRole : string
) {
const client = await clerkClient ()
const memberships = await client.organizations .getOrganizationMembershipList ({
organizationId : orgId,
})
const membership = memberships.data .find (
m =>publicUserData ?.userId === userId
)
if (!membership) throw new Error ('User is not a member of this organization' )
await client.organizations .updateOrganizationMembership ({
organizationId : orgId,
userId,
role : newRole,
})
}
Step 8: SAML SSO Configuration Configure in Clerk Dashboard > SSO Connections > Add SAML Connection :
ACS URL: https://<your-clerk-frontend-api>.clerk.accounts.dev/v1/saml/acsEntity ID: https://<your-clerk-frontend-api>.clerk.accounts.dev/v1/saml/metadataUpload IdP metadata XML from your provider (Okta, Azure AD, Google Workspace)
Map SAML attributes: email, firstName, lastName
Error Handling Error Cause Solution orgId is nullNo active organization Redirect to org selector, show <OrganizationSwitcher /> has() returns falseRole/permission not assigned Check assignment in Dashboard > Organizations > Members Permission denied on middleware User lacks required role Verify route matcher maps to correct role SSO login fails Misconfigured IdP metadata Verify ACS URL and Entity ID in IdP settings Invitation fails Email already a member Check membership before inviting Custom role not visible Created via API, not Dashboard Roles created via API are org-scoped, not instance-wide
Enterprise Considerations
Roles and permissions are embedded in the session JWT -- no extra network requests needed for authorization checks
Custom roles created in the Dashboard are instance-wide; roles created via Backend API are organization-scoped
For multi-tenant SaaS, combine Organizations with tenant-scoped database queries (WHERE org_id = :orgId)
Session claims include org_id, org_role, and org_permissions -- available in middleware without API calls
Verified domains + SAML SSO enable "just-in-time provisioning" -- users auto-join the org on first SSO sign-in
Consider the org:sys_* system permissions (sys_memberships:manage, sys_memberships:read, sys_domains:manage) for built-in org management actions
Resources
Next Steps Proceed to clerk-migration-deep-dive for auth provider migration.
Output
RBAC model mapping Clerk orgs/roles/permissions to app authorization checks
Code or config for role gates (middleware, server actions, or API guards)
Escalation notes for SSO/SAML enterprise setups when in scope
Examples
Map org roles to feature access User: Only org:billing can open the invoices page.
Skill: implements role check on the server and fails closed when claims missing.
Audit permission matrix User: Produce a role × capability matrix for our Clerk org roles.
Skill: enumerates Clerk roles/permissions and maps them to app routes/actions.
