Emulating tenants using roles

9
votes

We are developing a keycloak(5.0.0) based solution where our clients can create their account with us and manage their own users - and only their users.

Initially with thought that we could use realms for this. Every client gets their own realm. After initial testing we deemed it might not be a good solution as after creating ~500 realms the application becomes unresponsive(https://issues.jboss.org/browse/KEYCLOAK-4593).

We decided to try using Groups to emulate a tenant. Our objective is to create during an external process(keycloak REST API) a group with an admin user. Can't find currently a way how to restrict this administrator to be able to only manage their own group(creating subgroups, managing users, and giving them roles).

I've noticed several emails mentioning these features but I fail to find actual examples to make this work.

The second link shows exactly what we would like to achieve.

Current alternative I can see is to implement a facade(client or separate web app) which would restrict visibility and access to other groups.

Are there other alternatives?

keycloak
How have achieved multi-tenant with keycloak finally? – ravthiru
We are using groups, instead of realms and created special endpoints where specific users has to access only to the groups. – Łukasz Młynik
thanks for sharing the your experience – ravthiru
@ŁukaszMłynik could you share any update on specific API which you have used to enforce your group permission requirement? – Swistak
@ŁukaszMłynik can you please provide your solution as an anwser to your question? – Tiago Stapenhorst Martins