<div dir="ltr">Sorry, I just noticed that my example was wrong...<div><br></div><div>here is what I meant:</div><div><br></div><div><div style="font-family:arial,sans-serif;font-size:13px">|- realm</div><div style="font-family:arial,sans-serif;font-size:13px">
| |-users</div><div style="font-family:arial,sans-serif;font-size:13px">| | |-realm-level-user-1</div><div style="font-family:arial,sans-serif;font-size:13px">| | |-...</div><div style="font-family:arial,sans-serif;font-size:13px">
| |-tenants</div><div style="font-family:arial,sans-serif;font-size:13px">| | |-tenant-1</div><div style="font-family:arial,sans-serif;font-size:13px">| | | |-users</div><div style="font-family:arial,sans-serif;font-size:13px">
| | | | |-tenant-level-user-1</div><div style="font-family:arial,sans-serif;font-size:13px">| | | | |-...</div></div><div><br></div><div>However, nested realms would be an alternative I guess.</div><div><br></div>
<div>Cheers,</div><div>Nils</div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, May 30, 2014 at 8:12 PM, Nils Preusker <span dir="ltr"><<a href="mailto:n.preusker@gmail.com" target="_blank">n.preusker@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Bill,<div><br></div><div>I guess you are right, there isn't really a difference. It would just be important to be able to add realms at runtime. Are you suggesting to have nested realms (just replacing tenant with realm in my previous example)?</div>
<div><br></div><div>Does that make more sense?</div><div>Cheers,</div><div>Nils</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, May 30, 2014 at 6:05 PM, Bill Burke <span dir="ltr"><<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I don't what the different between a tenant and a realm would be in your<br>
example.<br>
<div><br>
On 5/30/2014 5:28 AM, Nils Preusker wrote:<br>
> Hi Bill,<br>
><br>
> what I was thinking of was tenants as nested element within a realm.<br>
><br>
> We'd like to be able to add tenants at runtime. That's where I see a<br>
> problem with multi-realm support, since realms are "hardcoded" in the<br>
> keycloak.json. So if you add a realm in the admin-console, with<br>
> multi-realm support you'd still have to modify the deployed WAR by<br>
> adding the new realm to the keycloak.json file.<br>
><br>
> I was thinking of a structure like this:<br>
><br>
> |- realm<br>
> | |-users<br>
> | |-realm-level-user-1<br>
> | |-...<br>
> |-tenants<br>
> | |-tenant-1<br>
> | | |-users<br>
> | | | |-tenant-level-user-1<br>
> | | | |-...<br>
><br>
> Let me know what you think!<br>
> Cheers,<br>
> Nils<br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
> On Thu, May 29, 2014 at 11:04 PM, Bill Burke <<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a><br>
</div><div><div>> <mailto:<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>>> wrote:<br>
><br>
> Somebody else was asking for this feature. We may have to add it beta 2<br>
> even though I wanted to have a feature freeze.<br>
><br>
> How did you expect it to work? One guy wanted to discover realm per<br>
> request via parsing the URL. Another guy just wanted multi-realm<br>
> support for bearer-only services.<br>
><br>
><br>
> On 5/29/2014 4:54 PM, Nils Preusker wrote:<br>
> > Hi,<br>
> ><br>
> > first of all, congrats on the beta 1 release!<br>
> ><br>
> > Here's my question: I have a WAR with a REST API that I'm<br>
> securing with<br>
> > Keycloak. Now I'd like to add multitenancy support.<br>
> ><br>
> > If I understand the concept in keycloak correctly, I would<br>
> somehow have<br>
> > to have several realms in the keycloak.json and the web.xml of<br>
> the war,<br>
> > right? However there is just one realm-name attribute in the<br>
> web.xml and<br>
> > the structure of keycloak.json also looks like it is intended for one<br>
> > realm. Am I missing something?<br>
> ><br>
> > Cheers,<br>
> > Nils<br>
> ><br>
> ><br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > keycloak-user mailing list<br>
</div></div>> > <a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a>><br>
<div>> > <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
> ><br>
><br>
> --<br>
> Bill Burke<br>
> JBoss, a division of Red Hat<br>
> <a href="http://bill.burkecentral.com" target="_blank">http://bill.burkecentral.com</a><br>
> _______________________________________________<br>
> keycloak-user mailing list<br>
</div>> <a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a>><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
<div><div>><br>
><br>
><br>
><br>
> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
><br>
<br>
--<br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" target="_blank">http://bill.burkecentral.com</a><br>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>