[keycloak-user] Multitenancy for WAR

[Bill Burke]

Travis, I did do most of the work for this.  I think I pinged you to see 
if you still wanted the feature, but never followed through.  I'm sorry.

All this would require a shared client secret, or public clients.  It 
would require you to extract the realm name somehow based on the current 
HTTP request.  Probably a URI pattern.

There is an AdapterDeploymentContext class.  This class has a method:

KeycloakDeployment resolveDeployment(HttpFacade)

This method get's called every request.  You would extend this class and 
override resolveDeployment and create (and then cache) your 
KeycloakDeployment based on the incoming HTTP request.

The only problem is that the current code has no way for you to plug in 
a new implementation of the AdapterDeploymentContext.

On 9/4/2014 2:36 AM, Travis De Silva wrote:
> Hi Stian,
>
> You proposed solution would not cover the use case where we can create
> tenants at runtime as the realm config in the keycloak.json would be
> hard coded into the war.
>
> I had discussed this identical use case a while ago on this forum and
> Bill was planning to refactor the adapters to support this use case.
> Unfortunately he got caught up in other tasks and was not able to
> proceed on this.
>
> The discussion thread is here
> http://lists.jboss.org/pipermail/keycloak-user/2014-March/000062.html
>
> Basically what I believe Bill suggested which would meet this use case
> is to:
>
>  1. Have a shared secret between clients for all realms.
>  2. The adapter would just extract the realm name from the request,
>     invoke on the keycloak server to get the public information about
>     the realm (i.e. public key) and then cache the information locally.
>
> The key bit here is extracting the realm name from the request and then
> pulling the realm info from the keycloak server.
>
> I had a look at the keycloak source code and I believe the magic happens
> in the KeycloakServletExtension class under the
> org.keycloak.adapters.undertow package for my use case (since I deploy
> it on wildfly)
>
> What I have got stumped is that this class gets loaded when my war is
> deployed and I am wondering how I can do it per request (if the info is
> not already cached locally)
>
> Maybe with the imminent release of 1.0 (btw congrats for the great work
> to everyone in the team and for Bill and your leadership), maybe we
> should start thinking about this multi tenancy use case to be included
> in future releases.
>
> I believe that SaaS models are going to be popular and having this
> feature added will make keycloak a major player in this space.
>
> Cheers
> Travis
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com