Hi, This question is slightly off-topic, I hope it's allowed to ask here. We are using keycloak as an IdP, loving it. One of our sister institutes  is using another (openid connect / saml2 compatible) IdP. Now a new project: Trying to achieve web SSO across both institutes, for  several web applications, mostly supporting only one single IdP. We have made a PoC using keycloak's brokering function, and it worked  nicely. However, our sister institute prefers a SaaS solution. I've done my googling, but terminology is confusingly different: - onelogin  ("trusted IdP") - okta ("inbound federation") - gluu ("inbound identity") and obviously - keycloak ("IdP brokering") (but not saas) and I am not even sure that the above solution are really the same as  keycloak's IdP brokering, and that they would solve our SSO requirement.  (doing a PoC would be the next step) So I am asking for recommendations from the guru's here. What are the  do's and don't for something like this? Perhaps suggestions what to look  for, what to avoid, what other products to take a look at, etc, etc. Insights? Thanks very much in advance, and again: apologies for being a bit  off-topic, hope not to offend anyone. MJ _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Hi Dmitri, Thanks for your follow-up. The idea is to both keep our current IdP's, and use an 'umbrella'  brokering IdP for the applications that need to be shared between the  two institutes. It's just the brokering IdP that has to be SaaS.

We also just discovered Ping Identity, making our shortlist: - PingIdentity - OneLogin - okta - gluu Anyone here with arguments against / in favour of / experience with one  of these options?

MJ On 14-11-2018 4:15, Dmitry Telegin wrote: > Quick question: do you plan to decommission both your Keycloak and > sister institute's IdP, and migrate everything to a SaaS IdP? Or you > want both your IdPs broker to SaaS? Or is your sister institute going > to migrate to SaaS IdP, and you have to broker to it from your > Keycloak?