Can multi-tenancy in Keycloak be done within a single realm?

18
votes

First, I'm well aware of the multi-realm approach to multi-tenancy in Keycloak. I've taken over a legacy project where nobody thought of multi-tenancy. Now, two years later, suddenly, the customer needs this feature. Actually, the microservices are prepared for this scenario out-of-the-box.

The customer develops a mobile app that authenticates users via API on our keycloak instance with an account number (as username) and a password. Now, he'd like to add an tenant id to the login information.

The customer wants to avoid using several endpoints as a multi-realm solution would demand.

One first idea was to just concatenate tenant-id and account-id on registration. But that's a smelly approach.

So, my thought was that there may be a way to configure Keycloak in a way that I add a custom tenantid field together with username that acts just like a composite primary key in the database world.

Is such a configuration possible? Is there another way to achieve multi-tenancy behaviour using a single realm?

1
multi-tenantkeycloak
Each one implemented multi-tenancy with keycloak differently depending on their use case, some use roles , some use groups stackoverflow.com/questions/55641667/…. You can also use user attributes to store tenantid – ravthiru
If the usernames are not unique across all tenants, you will somehow need to specify the tenant id during login. How do you want to provide it? Do you use the authentication flow of Keycloak, or do you really use a custom built API? If so, what's the result of the API call? Just a yes (username/password are correct) or no (username/password are incorrect)? – Codo
"The customer wants to avoid using several endpoints as a multi-realm solution would demand." You just need multi realms, the URL only differs in one point (NAME of the realm). Should be no problem to make the keycloak requests that flexible. – Julian Egner

1 Answers

3
votes

I can't say for sure, but after some research, I found this:

Data Organization

This website lists all of this together with more information:

https://lists.jboss.org/pipermail/keycloak-user/2017-June/010854.html

Check it out, it may help with your data organization in key-cloak.