<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Here i have a similar requirement for a saas application. Need to
have a single login form for all users and when the user logs in, i
have to descide to which tenant (and server) a user belongs. Then i
do a redirect to the right server / tenant.<br>
It's the same way most saas applications works (one login screen,
then you get redirected to the right server / application).<br>
<br>
If we want to have one single login form for all tenants, then we
can only have the users in the same realm i think, because you must
be sure that all the users are unique.<br>
But we also need a way to let a user log in into several tenants
with the same user. For that i plan to add a role for every tenant.
If a user has several such roles, he must choose to which tenant he
wants to connect.<br>
The application makes sure only a user with the correct role can use
a tenant.<br>
<br>
Maybe there is a better way to solve that?<br>
<br>
The best way to solve it would be to allow a user to be in more than
one realm and support a way to test in which realms a user is. Then
we can login the user and test the realm(s).<br>
But i think that wouldn't be possible because the hole design is
different. Maybe a "super realm" is possible that is a container for
such users?<br>
<br>
Best regards,<br>
Patrick<br>
<br>
<br>
<div class="moz-cite-prefix">Am 21.10.2015 um 14:46 schrieb Stian
Thorgersen:<br>
</div>
<blockquote
cite="mid:CAJgngAcHFw=6EfqD96J=yaWEDxWV++hPjEdxO5hCw4XHfekUEQ@mail.gmail.com"
type="cite">
<div dir="ltr">I think the first question to ask is do you want to
share users and config between tenants? If you do you should
have a single realm, if not you should have separate realms.</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On 21 October 2015 at 14:38, Thomas
Raehalme <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:thomas.raehalme@aitiofinland.com"
target="_blank">thomas.raehalme@aitiofinland.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote"><span class="">On Tue, Oct 20,
2015 at 8:20 PM, Stian Thorgersen <span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:sthorger@redhat.com"
target="_blank"><a class="moz-txt-link-abbreviated" href="mailto:sthorger@redhat.com">sthorger@redhat.com</a></a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Thousands should be no problem at
all. Tens of thousands should be ok, but we'd
have to test that. I guess you're building a
public api or something since you're expecting
that many clients?</div>
</blockquote>
<div><br>
</div>
</span>
<div>I have been thinking of various ways to utilize
Keycloak in a SaaS application. A separate realm per
tenant is probably the most natural option, but how
about using a single realm with individual clients
for each tenant, would that make any sense? I think
it would have its advantages (eg. the SaaS service
provider could use a single account to access any
tenant, and tenants could register themselves as
clients when being deployed?).<br>
</div>
<div><br>
</div>
<div>Best regards,<br>
</div>
<div>Thomas<br>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Näf ITCom AG
Patrick Andreas Näf
CEO / Owner
MSc ETH Inf.-Ing.
Höhenweg 7
4917 Melchnau
web: <a class="moz-txt-link-abbreviated" href="http://www.naef-itcom.ch">www.naef-itcom.ch</a></pre>
</body>
</html>