Re: [keycloak-user] Keycloack Multi -Tenancy question

Hello Litom, sorry for late response, hope it's still relevant, As an alternative, you could try what is sometimes called "soft-tenancy", which is basically a single-realm based solution with a number of tricks to emulate multi-tenancy. Here are the key points: - use single realm for all tenants; - model your tenants as groups, use group membership to assign users to tenants. This has advantage over multi-realm approach since it allows many-to-many user-tenant relationship (the same for client-tenant BTW); - establish client-tenant relationship using client attributes, or group attributes, or naming convention; - use custom authenticator to enforce tenant-client restrictions; - if you need to "scope" your session to a particular tenant, e.g. for login screen branding, use custom OpenID scope parameter like this: "scope=openid email profile tenant:XXX" - use custom authenticator to parse tenant ID and attach it to user session; - if needed, use custom protocol mapper to put tenant ID back into tokens; - if needed, use custom login forms provider + custom theme to brand login screen, see [1] (the same for account and email themes). Don't hesitate to ask any further questions. [1] https://github.com/dteleguin/keycloak-dynamic-branding Good luck, Dmitry Telegin Carretti Consulting OÜ | Keycloak Consulting and Training Sepapaja 6, Tallinn 15551, Estonia | info(a)carretti.pro On Mon, 2019-09-23 at 10:14 +0300, Litom Segal wrote: