<html><body><p>Dear Stian,</p><p> </p><p>we faced an issue when using KeyCloak with a multiple-tenant service and came up with a working solution we would like your opinion on.</p><p> </p><p>Our old approach was outlined as follows:</p><p>Each of our tenants was assigned a single realm. Within this realm, an "administrator" user was created that enabled the tenant to full extent within our application, but not within the KeyCloak realm itself.</p><p> </p><p>Our software utilized the master realms root user to obtain the JSON installation files for our respective services.</p><p>Thus, we ran into the problem of roots ever growing access rights, as described in this issue:</p><p><a href="https://issues.jboss.org/browse/KEYCLOAK-3067" data-mce-href="https://issues.jboss.org/browse/KEYCLOAK-3067">https://issues.jboss.org/browse/KEYCLOAK-3067</a></p><p> </p><p>The encoded list of roots rights in the “Authentication” header exceeded 8KB and our web server was unable to process any requests from this point onward.</p><p> </p><p>To get rid of this problem, we devised a literal workaround: Each realm gets its specific master user who is entitled with all rights the client “realm-management” has to offer- one could say we created a local root for each realm. This master now steps up to the hole left by root and provides the public keys etc. for our services. As its rights are limited to its own realm, its bearer token remains at a constant, reasonable size.</p><p> </p><p> </p><p>The (scripted) creation of such a new realm works like this:</p><p> </p><p>We manually added a user in the master realm who has no rights besides creating new users. We access this user via the admin-cli client and create a new user “creator”.</p><p>Creator is then assigned a random password (which is cached) and the role “create-realm”.</p><p> </p><p>In the next step, we access creator and create our new realm, complete with clients, roles, groups and the two users , the administrator and the master.</p><p> </p><p>After successful creation of the realm, creator has fulfilled its purpose and is deleted. As he possesses full rights in the newly created realm, his continued existence presents a potential insecurity with no practical use to justify it.</p><p> </p><p>The big downside of our new approach is the fact that the rights of the master realms root user still keep growing. So we inevitably lock ourselves out of the mater realm security console in the long run.</p><p>Of course, we’re still able to access each realms console via /auth/admin/<realm>/console with the master user.</p><p>Also, in the issue linked above, you commented that KeyCloak is not meant to be used with multiple realms. However, if the master realm was actually removed from KeyCloak in the future, our temporary workaround might yet turn into a long – lasting solution. Are we right on this part?</p><p> </p><p>Thank you very much for your consideration.</p></body></html>