<div dir="ltr">Hi Stan<div><br></div><div>Yes, that's what I thought - putting in some synchronisation smarts and locking down applications within tenants' realms.</div><div><br></div><div>Is this even on the roadmap? If we take a look at, say, Google - they have tenants (Google Apps for Business) who have their own domains, admins and users, and they also have applications accessible by all users of all tenants. </div><div><br></div><div><br></div><div>...on the other side, is it possible to use different approach and implement "tenant ID" as a User attribute within the realm?</div><div><br></div><div>Cheers</div><div>Egor</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 9, 2015 at 10:11 PM, Stian Thorgersen <span dir="ltr"><<a href="mailto:stian@redhat.com" target="_blank">stian@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
<br>
----- Original Message -----<br>
> From: "Egor Kolesnikov" <<a href="mailto:egor.kolesnikov@fastlane-it.com">egor.kolesnikov@fastlane-it.com</a>><br>
> To: <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> Sent: Thursday, 9 April, 2015 4:58:12 AM<br>
> Subject: [keycloak-user] Multi-tenancy applications<br>
><br>
> I've been using Keycloak for quite some time now on a couple of projects, and<br>
> it's absolutely awesome - it just does the right thing, straight out of the<br>
> box.<br>
><br>
> However, what I found quite confusing is the "Realm" definition which is<br>
> missing from the documentation.<br>
> I'm trying to add multi-tenancy support to our application and found it a bit<br>
> confusing. It seems that Keycloak's approach to multitenancy is "Realm per<br>
> tenant" - which makes sense, until it comes to realisation that the<br>
> applications only exist within realms. This implies that if there are few<br>
> hundreds of tenants (i.e. organisations using the application), the task of<br>
> changing application config (i.e. adding application-level role or<br>
> adding/removing redirect URL) becomes maintenance nightmare.<br>
><br>
> Is it at all possible to define a "global", not realm-confined application in<br>
> Keycloak? Would it be hard to implement? Happy to put some effort into it<br>
> and send a pull request.<br>
<br>
</span>It's not possible now and would require a lot of changes.<br>
<br>
The best idea I can come up with is to use the admin endpoints to automate replicating the applications for multiple realms. Would be relatively easy to write something that uses the application in one realm as a reference and duplicates it to other realms.<br>
<span class=""><br>
><br>
> A bit more context:<br>
> - I have an webapp that serves multiple organisations.<br>
> - Each organisation has its own users and admins (who can create users and<br>
> other admins).<br>
> - There is a "Super" administrator who creates organisations and admins.<br>
> - Webapp can recognise the organisation based on Company ID or domain name.<br>
><br>
> Many thanks in advance.<br>
><br>
</span>> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><font size="1"><img src="https://lh6.googleusercontent.com/-E54AWr32p7E/UGkoBvQSxNI/AAAAAAAAAAY/PZtZfMy-X9Y/s800/fastlane.png" height="41" width="96"><br>Egor Kolesnikov<br>Director<br>Fastlane Solutions Pty Ltd<br>m. +61(4) 6884 5909</font></div>
</div>