# Best Keycloak architecture for managing B2C customers, B2B clients, and internal employees?

**URL:** <https://forum.keycloak.org/t/best-keycloak-architecture-for-managing-b2c-customers-b2b-clients-and-internal-employees/30158>\
**Category:** Getting advice\
**Created:** [June 26, 2025, 1:24pm UTC](https://forum.keycloak.org/t/best-keycloak-architecture-for-managing-b2c-customers-b2b-clients-and-internal-employees/30158 "2025-06-26T13:24:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![okaydada](https://avatars.discourse-cdn.com/v4/letter/o/bb73d2/32.png) [@okaydada](https://forum.keycloak.org/u/okaydada)\
**Post date:** [June 26, 2025, 1:24pm UTC](https://forum.keycloak.org/t/best-keycloak-architecture-for-managing-b2c-customers-b2b-clients-and-internal-employees/30158/1 "2025-06-26T13:24:41Z")

</div>

Hello everyone,

I am planning to deploy Keycloak to manage authentication and authorization for:

- **B2C customers** (end users of our application)
- **B2B clients** (business customers with multiple users)
- **Internal employees** distributed across different departments

I’m trying to determine the best architecture to organize these users:

- Should I create **multiple realms** (one per user type)?
- Or should I use a **single realm with Organizations** to isolate B2B clients and employees, and **Groups** to segment users?
- How should I handle standard B2C customers who don’t belong to any organization?
- What are your experiences or best practices for multi-tenant setups in Keycloak for mixed scenarios like this?

Thanks in advance for your advice!

---

<div class="post-metadata">

**Author:** ![dteleguin](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dteleguin/32/11917_2.png) [@dteleguin](https://forum.keycloak.org/u/dteleguin)\
**Post date:** [June 26, 2025, 2:04pm UTC](https://forum.keycloak.org/t/best-keycloak-architecture-for-managing-b2c-customers-b2b-clients-and-internal-employees/30158/2 "2025-06-26T14:04:57Z")

</div>

Hello @okaydada,

Indeed, in Keycloak there are many levels of hierarchies (Keycloak instances - realms - organizations - groups - subgroups etc.) The answer depends on your particular requirements, policies, how you plan to implement SSO, protocols you’re planning to use (OIDC/SAML), your application’s cryptographic capabilities and even the expected number of tenants. Depending on that, any combinations could be possible.

---

<div class="post-metadata">

**Author:** ![okaydada](https://avatars.discourse-cdn.com/v4/letter/o/bb73d2/32.png) [@okaydada](https://forum.keycloak.org/u/okaydada)\
**Post date:** [June 26, 2025, 5:22pm UTC](https://forum.keycloak.org/t/best-keycloak-architecture-for-managing-b2c-customers-b2b-clients-and-internal-employees/30158/3 "2025-06-26T17:22:33Z")

</div>

[quote=“dteleguin, post:2, topic:30158, full:true”]  
Hello @okaydada, We are currently designing a secure identity and access management system with Keycloak to handle multiple user types and applications. Our key requirements are:

#### 🔐 Authentication

- We want to use **OpenID Connect (OIDC)** as the main authentication protocol.
- Users can authenticate using:
  - **Username + password** , or
  - **External Identity Providers (Google, Facebook)** via OIDC.

- **MFA (Multi-Factor Authentication) is mandatory** for all users.
  - We already have users using **Google Authenticator (TOTP)** for OTP.
  - We plan to **migrate those existing TOTP secrets** into Keycloak’s credential storage.

#### 🔁 SSO

- We want **SSO enabled** across multiple applications, especially:
  - Internal apps (for employees),
  - B2B portals (for enterprise clients),
  - B2C apps (at least three), where a user account in one app must grant access to the others.

* * *

### 👥 **User segmentation**

We manage three main user types:

1. **Internal employees**

- Access an internal app.
- Organized by department (HR, support, dev, etc.).

1. **B2B clients**

- Represented by organizations or top-level groups.
- May include multiple users and subgroups per company.

1. **B2C users**

- End customers using our consumer-facing apps.
- Simpler structure, no subgroups needed, but SSO across apps is required.

---

<div class="post-metadata">

**Author:** ![Joachim](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@Joachim](https://forum.keycloak.org/u/Joachim)\
**Post date:** [June 26, 2025, 6:44pm UTC](https://forum.keycloak.org/t/best-keycloak-architecture-for-managing-b2c-customers-b2b-clients-and-internal-employees/30158/4 "2025-06-26T18:44:34Z")

</div>

my 2cts:

> [@okaydada](#):
>
> Internal employees

if you are using active directory, go for kerberos. No password is more secure than MFA.

> [@okaydada](#):
>
> B2B clients

if you and they can, delegate IAM to them. Eases all lifes in case someone leaves the organization. Maybe they use kerberos as well..

> [@okaydada](#):
>
> B2C users

This is likely the only situation where you have to manage new users.

---

<div class="post-metadata">

**Author:** ![dteleguin](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dteleguin/32/11917_2.png) [@dteleguin](https://forum.keycloak.org/u/dteleguin)\
**Post date:** [July 10, 2025, 3:31pm UTC](https://forum.keycloak.org/t/best-keycloak-architecture-for-managing-b2c-customers-b2b-clients-and-internal-employees/30158/5 "2025-07-10T15:31:28Z")

</div>

It looks like the three categories of users (internal, B2B, B2C) are pretty much isolated, and there is no requirement for SSO across the categories. I’d recommend starting with three realms and using groups and/or organizations to model the business hierarchy.

One of the benefits of the above approach is that if any of the realms starts producing significant load (which could affect other user categories), you’ll be able to easily migrate it to a different Keycloak server/cluster.