<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:13px"><div id="yui_3_16_0_1_1450435994260_7124">Perhaps the ideas below would work but I think it simply complicates things and not warranted as a single realm is what we are looking for. Based on what we saw in other commercial products, I am wondering why the themes/login pages can't be dynamically served by a Server component with everything else being the same. My apologies if I am overlooking something as I haven't really looked into the themes in KC.</div><div class="qtdSeparateBR" id="yui_3_16_0_1_1450435994260_7272"><br></div><div class="yahoo_quoted" id="yui_3_16_0_1_1450435994260_7130" style="display: block;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 13px;" id="yui_3_16_0_1_1450435994260_7129"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1450435994260_7128"> <div dir="ltr" id="yui_3_16_0_1_1450435994260_7127"> <font size="2" face="Arial" id="yui_3_16_0_1_1450435994260_7126"> <hr size="1" id="yui_3_16_0_1_1450435994260_7271"> <b><span style="font-weight:bold;">From:</span></b> Marek Posolda <mposolda@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> stian@redhat.com <br><b><span style="font-weight: bold;">Cc:</span></b> Raghuram Prabhala <prabhalar@yahoo.com>; keycloak-user <keycloak-user@lists.jboss.org><br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, December 18, 2015 3:44 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [keycloak-user] Different theme for each client<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_1_1450435994260_8229"><br><div id="yiv9215895751"><div id="yui_3_16_0_1_1450435994260_8228">
<div class="yiv9215895751moz-cite-prefix" id="yui_3_16_0_1_1450435994260_8227">On 18/12/15 09:39, Stian Thorgersen
wrote:<br clear="none">
</div>
<blockquote type="cite" id="yui_3_16_0_1_1450435994260_8231">
<div dir="ltr" id="yui_3_16_0_1_1450435994260_8230"><br clear="none">
<div class="yiv9215895751gmail_extra" id="yui_3_16_0_1_1450435994260_8232"><br clear="none">
<div class="yiv9215895751gmail_quote" id="yui_3_16_0_1_1450435994260_8233">On 18 December 2015 at 09:35, Marek
Posolda <span dir="ltr"><<a rel="nofollow" shape="rect" ymailto="mailto:mposolda@redhat.com" target="_blank" href="mailto:mposolda@redhat.com">mposolda@redhat.com</a>></span>
wrote:<br clear="none">
<blockquote class="yiv9215895751gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;" id="yui_3_16_0_1_1450435994260_8236">
<div id="yui_3_16_0_1_1450435994260_8235"><span class="yiv9215895751">
</span><div id="yui_3_16_0_1_1450435994260_8234">On 18/12/15 08:23, Stian Thorgersen wrote:<br clear="none">
</div>
<blockquote type="cite">
<div dir="ltr">The best solution to that is either
the ability to share users between realms or more
likely the ability to define a SSO group within a
realm. Each SSO group would have independent SSO
sessions and could also have separate themes
associated with it. It's not something we have
resources for right now though. <br clear="none">
</div>
</blockquote>
I wonder if we can have something like
"different-realm-user-federation-provider" ? We had
something like this in the early days of Keycloak.<br clear="none">
<br clear="none">
For example, if you have 2 realms "blueRealm" and
"greenRealm" . The greenRealm will have defined
federation provider, which will delegate retrieving
users to blueRealm. Then all applications configured
against greenRealm will see green login screen, but they
will be able to authenticate with users+passwords from
blueRealm. <br clear="none">
</div>
</blockquote>
<div><br clear="none">
</div>
<div>That's not very elegant at least not ATM as we would
end up duplicating the users in the DB.</div>
</div>
</div>
</div>
</blockquote>
Yeah. Once we address in-memory federation, it's going to be better
though. Might be easier then introduce brand new concept of SSO
groups within realm.<div class="yiv9215895751yqt6343386413" id="yiv9215895751yqtfd24996"><br clear="none">
<br clear="none">
Marek<br clear="none">
<blockquote type="cite">
<div dir="ltr">
<div class="yiv9215895751gmail_extra">
<div class="yiv9215895751gmail_quote">
<div> </div>
<blockquote class="yiv9215895751gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><span class="yiv9215895751HOEnZb"><font color="#888888"> <br clear="none">
Marek</font></span>
<div>
<div class="yiv9215895751h5"><br clear="none">
<br clear="none">
<blockquote type="cite">
<div dir="ltr">
<div><br clear="none">
</div>
<div>Simply displaying a different theme
per-client just doesn't make any sense at all.
Users log-in to a SSO realm, not an individual
client. So I'm against adding something like
that unless we add the ability to log-in to
clients or groups of clients individually.</div>
</div>
<div class="yiv9215895751gmail_extra"><br clear="none">
<div class="yiv9215895751gmail_quote">On 18 December 2015 at
03:08, Raghuram Prabhala <span dir="ltr"><<a rel="nofollow" shape="rect" ymailto="mailto:prabhalar@yahoo.com" target="_blank" href="mailto:prabhalar@yahoo.com"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:prabhalar@yahoo.com" target="_blank" href="mailto:prabhalar@yahoo.com">prabhalar@yahoo.com</a>></span>
wrote:<br clear="none">
<blockquote class="yiv9215895751gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:13px;">
<div>Pe</div>
<br clear="none">
<div>It depends upon the application
that the user accesses. We have
several scenarios where the same set
of users login to different
applications in different divisions,
some internet facing that have a
totally different look from our
intranet ones and it also depends upon
whether the applications look for
multi factor authentication as well.</div>
<div><br clear="none">
</div>
<div>This is a very common scenario - We
typically have different themes
presented to the users based on what
the client applications request
(different themes can be requested
utilizing different http parameters)</div>
<div><br clear="none">
</div>
<div dir="ltr">Perhaps we can define
different realms for different themes
but it becomes very cumbersome<br clear="none">
</div>
<div><br clear="none">
</div>
<div><br clear="none">
<br clear="none">
</div>
<div style="display:block;">
<div style="font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:13px;">
<div style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;">
<div dir="ltr"> <font face="Arial" size="2"><span>
</span></font><hr size="1"> <b><span style="font-weight:bold;">From:</span></b>
Stian Thorgersen <<a rel="nofollow" shape="rect" ymailto="mailto:sthorger@redhat.com" target="_blank" href="mailto:sthorger@redhat.com"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:sthorger@redhat.com" target="_blank" href="mailto:sthorger@redhat.com">sthorger@redhat.com</a>><br clear="none">
<b><span style="font-weight:bold;">To:</span></b>
Raghuram Prabhala <<a rel="nofollow" shape="rect" ymailto="mailto:prabhalar@yahoo.com" target="_blank" href="mailto:prabhalar@yahoo.com"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:prabhalar@yahoo.com" target="_blank" href="mailto:prabhalar@yahoo.com">prabhalar@yahoo.com</a>>
<br clear="none">
<b><span style="font-weight:bold;">Cc:</span></b>
Revanth Ayalasomayajula <<a rel="nofollow" shape="rect" ymailto="mailto:revanth@arvindinternet.com" target="_blank" href="mailto:revanth@arvindinternet.com"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:revanth@arvindinternet.com" target="_blank" href="mailto:revanth@arvindinternet.com">revanth@arvindinternet.com</a>>;
keycloak-user <<a rel="nofollow" shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>><br clear="none">
<b><span style="font-weight:bold;">Sent:</span></b>
Thursday, December 17, 2015
9:28 AM
<div>
<div><br clear="none">
<b><span style="font-weight:bold;">Subject:</span></b>
Re: [keycloak-user]
Different theme for each
client<br clear="none">
</div>
</div>
</div>
<div>
<div>
<div><br clear="none">
<div>
<div>
<div dir="ltr"><br clear="none">
<div><br clear="none">
<div>On 17 December
2015 at 14:44,
Raghuram Prabhala
<span dir="ltr"><<a rel="nofollow" shape="rect" ymailto="mailto:prabhalar@yahoo.com" target="_blank" href="mailto:prabhalar@yahoo.com"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:prabhalar@yahoo.com" target="_blank" href="mailto:prabhalar@yahoo.com">prabhalar@yahoo.com</a>></span>
wrote:<br clear="none">
<blockquote style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:13px;">
<div dir="ltr"><span>Stian
- Even we have
a similar
requirement of
having
different
themes, but
for different
divisions
within the
firm. Some of
them have
additional
functionality
of changing
even the
password. Can
you suggest
some way of
achieving the
above
functionality
considering
that all the
other
functionality
is the same
for all
divisions?</span></div>
</div>
</div>
</blockquote>
<div><br clear="none">
</div>
<div>Not actually
sure what you
mean here. It
just doesn't
make sense to
show a user two
login pages that
look different
(and possible
have different
things
enabled/disable)
if they use the
same realm and
SSO session.</div>
<div>
<div> </div>
<blockquote style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:13px;">
<div dir="ltr"><span><br clear="none">
</span></div>
<div dir="ltr"><span>Thanks,</span></div>
<div dir="ltr"><span>Raghu</span></div>
<div><br clear="none">
</div>
<div style="display:block;">
<div style="font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:13px;">
<div style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;">
<div dir="ltr">
<font face="Arial" size="2"> </font>
<hr size="1">
<b><span style="font-weight:bold;">From:</span></b>
Stian
Thorgersen
<<a rel="nofollow" shape="rect" ymailto="mailto:sthorger@redhat.com" target="_blank" href="mailto:sthorger@redhat.com"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:sthorger@redhat.com" target="_blank" href="mailto:sthorger@redhat.com">sthorger@redhat.com</a>><br clear="none">
<b><span style="font-weight:bold;">To:</span></b>
Revanth
Ayalasomayajula
<<a rel="nofollow" shape="rect" ymailto="mailto:revanth@arvindinternet.com" target="_blank" href="mailto:revanth@arvindinternet.com"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:revanth@arvindinternet.com" target="_blank" href="mailto:revanth@arvindinternet.com">revanth@arvindinternet.com</a>>
<br clear="none">
<b><span style="font-weight:bold;">Cc:</span></b>
keycloak-user
<<a rel="nofollow" shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>><br clear="none">
<b><span style="font-weight:bold;">Sent:</span></b>
Thursday,
December 17,
2015 8:05 AM<br clear="none">
<b><span style="font-weight:bold;">Subject:</span></b>
Re:
[keycloak-user]
Different
theme for each
client<br clear="none">
</div>
<div>
<div>
<div><br clear="none">
<div>
<div>
<div dir="ltr">Having
different
clients login
to the same
SSO realm with
different
branded login
pages just
doesn't make
sense. If we
add the
concept of a
SSO
domain/zone or
something
within a
realm, where a
group of
clients have
separate
themes and SSO
session that
would make
sense.</div>
<div><br clear="none">
<div>
<div>On 15
December 2015
at 12:14,
Revanth
Ayalasomayajula
<span dir="ltr"><<a rel="nofollow" shape="rect" ymailto="mailto:revanth@arvindinternet.com" target="_blank" href="mailto:revanth@arvindinternet.com"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:revanth@arvindinternet.com" target="_blank" href="mailto:revanth@arvindinternet.com">revanth@arvindinternet.com</a>></span>
wrote:<br clear="none">
<blockquote style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div dir="ltr">+1
for this
feature.</div>
<div style="max-height:1px;"><img style="width:0px;max-height:0px;overflow:hidden;" data-id="7f008193-e7b1-cee6-55bf-d962ebb308b3"><font size="1" color="#ffffff">ᐧ</font></div>
<div><br clear="none">
<div>
<div>
<div>On Tue,
Dec 15, 2015
at 4:39 PM,
Helder dos S.
Alves <span dir="ltr"><<a rel="nofollow" shape="rect" ymailto="mailto:helder.jaspion@gmail.com" target="_blank" href="mailto:helder.jaspion@gmail.com"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:helder.jaspion@gmail.com" target="_blank" href="mailto:helder.jaspion@gmail.com">helder.jaspion@gmail.com</a>></span>
wrote:<br clear="none">
</div>
</div>
<blockquote style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<div>
<div dir="ltr">
<div>Hi.</div>
<div><br clear="none">
</div>
<div>I need to
have a
different
theme for each
of the clients
of a realm.</div>
<div>If a user
came from one
client, I have
to show a
keycloak page
with the logo
and skin of
that client.</div>
<div>Is it
possible with
Keycloak? How?</div>
<div><br clear="none">
</div>
<div>Thanks in
advance.</div>
<span></span>
<div><br clear="none">
</div>
<br clear="all">
<div>
<div>
<div dir="ltr">
<div>
<div dir="ltr">Helder
S. Alves<br clear="none">
</div>
</div>
</div>
</div>
</div>
</div>
<br clear="none">
</div>
</div>
_______________________________________________<br clear="none">
keycloak-user
mailing list<br clear="none">
<a rel="nofollow" shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br clear="none">
<a rel="nofollow" shape="rect" target="_blank" href="https://lists.jboss.org/mailman/listinfo/keycloak-user"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-freetext" target="_blank" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br clear="none">
</blockquote>
</div>
<br clear="none">
</div>
<br clear="none">
_______________________________________________<br clear="none">
keycloak-user
mailing list<br clear="none">
<a rel="nofollow" shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br clear="none">
<a rel="nofollow" shape="rect" target="_blank" href="https://lists.jboss.org/mailman/listinfo/keycloak-user"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-freetext" target="_blank" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br clear="none">
</blockquote>
</div>
<br clear="none">
</div>
</div>
</div>
</div>
<br clear="none">
<div>_______________________________________________<br clear="none">
keycloak-user
mailing list<br clear="none">
<a rel="nofollow" shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-abbreviated" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br clear="none">
<a rel="nofollow" shape="rect" target="_blank" href="https://lists.jboss.org/mailman/listinfo/keycloak-user"></a><a rel="nofollow" shape="rect" class="yiv9215895751moz-txt-link-freetext" target="_blank" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></div>
<br clear="none">
<br clear="none">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div><br clear="none">
</div>
</div>
</div>
</div>
</div>
<br clear="none">
<br clear="none">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br clear="none">
</div>
<br clear="none">
<fieldset></fieldset>
<br clear="none">
<pre>_______________________________________________
keycloak-user mailing list
<a rel="nofollow" shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" target="_blank" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a rel="nofollow" shape="rect" target="_blank" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br clear="none">
</div>
</div>
</div>
</blockquote>
</div>
<br clear="none">
</div>
</div>
</blockquote>
<br clear="none">
</div></div></div><br><br></div> </div> </div> </div></div></body></html>