Re: [keycloak-user] Keycloak support for one realm on a domain name while serving on multiple domains simultaneously

I've also posted this question on stackoverflow. So if you want to you can answer there so it'll be easier to find for anyone looking. Here it is: https://stackoverflow.com/questions/55634962/keycloak-support-for-one-rea... I'm building an ecosystem of applications on kubernetes with keycloak as authentication/authorization provider. I am(or probably was) planning for everything to be integrated with it via OpenId(OAuth2) and for user credentials and other private information never to leave the keycloak instance in an unencrypted form. I was trying to implement the whole authentication scheme with the following configurations in mind. Realms myservice: Realm containing the public and back-office users of my application. All microservices that I have are authenticating users against this realm. master: Contains admins, keycloak administrators and other resources which should not be ever exposed to the public or intranet users. No microservice ever performs authentication on this realm. Domains 1. domain: account.myservice.com access: public cors: allow requests from app.myservice.com config: kubernetes-ingress exposes: configured themes to support login, registration, etc.. Endpoints for public front-end application token validation description: Only exposes access to a realm called "myservice" in keycloak. No users from other realms can login or interact. 2. domain: account.internal.myservice.com access: intranet/admins cors: allow requests from back-office.internal.myservice.com config: kubernetes-ingress exposes: configured themes to support login, registration, etc.. Endpoints for back-end front-end application token validation description: Exposes all the realms and provides access to keycloak administrative UI. 3. domain: keycloak (keycloak.default.svc.cluster.local) access: cluster-internal cors: none config: kubernetes service, visible only inside the cluster exposes: endpoints for back-end application token validation description: Only exposes realm "myservice" and is used for other services to validate user tokens and similar stuff. I did come across a number of issues when trying to implement the above configuration scheme. If I do SSL termination inside Keycloak I won't be able to configure the different domains via a reverse proxy or similar approach which, in turn, means that Keycloak should provide a feature to listen on a separate SSL encrypted port and only make one realm available there. Which it does not. So do I want something weird here? Are the best practices different from what I want? -- Best Regards, Yervand