Hello, So here is my situation : The applications using keycloak as their authentication server need to be able to grant access to features based on the couple “role+company”. For instance : I log into my app, select somehow I’m working for “company A” and the app can see I am granted “admin” rol…

I finally found this which describes the exact same need as mine : [image] Single realm, multi-tenant, tenant scoped role setup advice Getting advice Dear Keycloakers, We are investigating Keycloak as a future IAM solution to replace an in-house developed one. we would lo…

Hi Vincent, Yes we could not really find a way to do this nicely out of the box. Currently we are abusing the group system as I mentioned in the initial post there. It sort of works for our use case as we have the claim in the token "new-claim": [ "/tenantA/role1" "/tenantA/role2", "/tenant…

Hi ! Thanks a lot for your input ! Ok so you’re abusing the group system while I’m abusing de role system :smiley: Indeed I discarded the group approach because of all of the duplication. We have currently ~25000 “tenants” and growing, so I don’t feel it would end up nicely… although it could be…

We are a bit under 25000, and not too far along the intergration as we are rolling this out with a new app, so no performance issues yet, but I see why you would not want to! Another approach we considered was to introduce a multivalued user attribute which would contain values like tenant:role. Yo…

Oh that’s an interesting approach. I’ll look into that. Thanks a lot !

Hello, To improve performance in a multi-tenant setup, you can retrieve the JWT token by scope, allowing the app to authenticate based on the tenant and group context. For example, if you’re authenticated in the app for company-A, the token could look like this: Example 1: Token for company-A with…

Hello @Aym , thanks a lot for your input. If I am not mistaken, it means a scope is created for each tenant, right ? Is it OK for keycloak to handle 25000+ scopes ? Or do you suggest using the “dynamic scopes” experimental feature ? Seems really interesting but it has been flagged as “experimental…

How to bind client role + group to represent a unique "role" ? (app level multi-tenancy)

Getting advice

VincentB99 December 5, 2024, 2:48pm 2

I finally found this which describes the exact same need as mine :

Seems not resolved though

Topic		Replies	Views
Single realm, multi-tenant, tenant scoped role setup advice Getting advice multi-tenancy	22	683	August 26, 2024
Keycloak group based multitenancy Getting advice	2	568	December 2, 2022
Group level administrators assigning client roles Getting advice admin-console	0	573	November 12, 2020
Best practice for modeling multitenant company to employee relationship Getting advice	1	2142	March 16, 2021
Multi tenancy :- Which is the best approch	1	507	October 31, 2022

How to bind client role + group to represent a unique "role" ? (app level multi-tenancy)

Related topics