yes the application itself needs to handle multiple realms at once. We are going with a shared application multi tenancy model.
Basically the flow I had in mind was:
Tenant Registration Process
Each tenant will get their own url
When a new tenant signs up, they can specify their url.
We would then create the realm for the client in Keycloak (via API calls) and associate the realm id to the url (either in keycloak or our application)
Login process for users of the tenant
When a user logs in via their tenant specific url, we will intercept that request in a filter and using the Authorization header grab the token and accordingly handle the authorization. If user has not logged in, we will redirect to keycloak for authentication
I had a look at your thoughts on how to do this with Aerogear. If I understand the concept correctly, with the UPS + Keycloak in one bundle option, we have to update the jboss wildfly config on the fly whenever we get new tenants. I did not think of this option and not sure if this could be done with wildfly without having to restart wildfly, but even if that is possible, that means we are going to have a large list of wildfly adapter profiles and I don't think that is practical. Just think even if we get 200 tenants, this is going to make it very complicated. Also I think the concept is one war per realm so this might not even be possible for a single application multi tenant model.
I think the ideal would be to have one wildfly adapter config per Keycloak instance. (i.e. don't go to the realm level) If you want to keep the existing and also cater to what I am suggesting, then some wildcard method to config would do.
Having said that, now I am wondering if by using the Per war configuration (and not using the wildfly adapter) if I could achieve what I want since from the keycloak docs, it looks like you can configure keycloak per war without specifying any realm specific settings. (at least for now the realm-name element is supposed to be ignored.)
Not sure if I have complicated this further or if this is doable. But if we can plug in multi tenancy that would be a massive win for Keycloak considering that everything is now moving to the cloud.