[keycloak-user] user storage ldap or keycloak

[Bill Burke]

Keycloak can handle responsibilities of a main user store and I would 
recommend you do that.  The few customers that I've seen take your 
approach struggled a bit with tuning LDAP to get it to perform well.  
With Keycloak only store, there's just one less moving part you have to 
worry about, tune, and debug.

The disadvantage is that you'll have to migrate from Keycloak DB to LDAP 
or something if you ever want to ditch Keycloak.

Another option: using the User Storage SPI you do have the option to 
retain your legacy user store.


On 1/26/17 2:00 PM, Istvan Orban wrote:
> Dear Keycloak users.
>
> I am very new to keycloak and I really like it. it is great.
>
> I am currently migrating a legacy app ( using it's own user management ) to
> support SSO.
>
> I have set-up keycloak with openid connect and it works very well. At this
> point we need to decide
> if we will use keycloak as our main user store or we will set-up an LDAP.
>
> My question is that. Is keycloak designed in a way that it can fullfil all
> the responsibilities of the main user store?
>
> Any risk with this at all?
>
> ps: our userbase is small and at this point I am not sure if we want to add
> ldap just for this.
>
>
>