B2B implementation with multiple connections to Microsoft Office365

Configuring the server
1

Hi,

We have a .NET Core web application and are looking at several alternatives to manage users and to implement single sign on for our customers, which are businesses. We came across Keycloak and have been able to secure an example app using Keycloak, including Microsoft 365 as IDP.

We are trying several things to make sure all alternatives we test have sufficient functionality to suit our needs.

One thing we came across using Keycloak is that we are not able to add multiple Microsoft IDP’s. We get the notification “Could not create the identity provider: Identity Provider microsoft already exists”.
This is a use case we are looking for because we offer B2B services and our clients often use 365.

Is there any way to make this work? Is there some setting we have not seen? Or is creating multiple realms (and connecting our application to multiple realms using OIDC) the only way to achieve this? Please take note that we have over a hundred customers which may need a single sign-on connection so maintainability of all this configuration is very important for us.

Or are there any other suggestions?

Props to Keycloak by the way, ease of implementation and documentation are top notch.

Thanks in advance!

2

If you don’t use the built-in “Microsoft” IdP, but instead use the generic “OIDC” IdP, you can make as many as you want. I think the others were originally designed as “social” IdPs, and the assumption was that you’d only ever have one of each.

3

Additionally, AFAIK the Microsoft social provider has some hardcoded URLs inside that allow only private MS accounts to be used.
For business accounts you habe to use the generic OIDC provider.

1 Like
4

The generic OIDC solved our issue. Thank you!