There is no way to specify for which org/loc user will be created in foreman.

Steps:
1. Configure keycloak as per https://www.theforeman.org/2018/06/using-saml-for-single-sign-on-to-foreman-through-keycloak.html
2. Create role in foreman with activation key view/delete/update/create permissions
3. Create usergroup in keycloak
4. Create usergroup with external usergroup as per keycloak and assign role created.
5. Login with user and visit activation key page.

Result:

Error 403 as user wont have org/loc assigned.

Expected :
Find a way to assign a default org/location to users that come from keycloak.