I’m working in an environment where I have to sync user-data between oracle databases, few LDAPs, two active directories and services like Azure. Syncing a credential, especially a publik key one, is not really challenging.
But yeah, I don’t plan to sync all credentials permanently between many stores. Ideally you have one credential store only - but one that allows you to migrate credentials to another store if you need to in the future.
Also the “enroll credential for user” option requires this kind of access.
Thing is, I may need PrivacyIDEA in the future. I now do have keycloak though and I want to enroll WebAuthN 2FA asap. So I want to make sure if I decide to use KC now and migrate to PrivacyIDEA later (as credential store), I can do this without starting over.
I may also look into GitHub - privacyidea/keycloak-provider: 🔒 OTP Two Factor Authentication Provider for Keycloak to run with privacyIDEA or other credential providers