# Multi-tenancy on Java EE aplication not working

**URL:** <https://forum.keycloak.org/t/multi-tenancy-on-java-ee-aplication-not-working/19807>\
**Category:** Securing applications\
**Tags:** adapter-java, multi-tenancy\
**Created:** [January 23, 2023, 3:08pm UTC](https://forum.keycloak.org/t/multi-tenancy-on-java-ee-aplication-not-working/19807 "2023-01-23T15:08:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pjmalandrino](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/pjmalandrino/32/6153_2.png) [@pjmalandrino](https://forum.keycloak.org/u/pjmalandrino)\
**Post date:** [January 23, 2023, 3:08pm UTC](https://forum.keycloak.org/t/multi-tenancy-on-java-ee-aplication-not-working/19807/1 "2023-01-23T15:08:53Z")

</div>

Hi,

I am actually trying to deploy a vanilla Java EE app with multi-tenancy (Tomcat 8.5 used as server).  
I have my keycloak running on a Docker instance with 2 realms configured (18.0.2 version).

Standard configuration (one tenant) is working :  
With a single keycloak.json and a keycloak Filter, application is reaching login page and everything is fine.

In other hand, when we activate multi-tenant configuration, we got a 403 directly.

**web.xml**

```auto
  <filter>
        <filter-name>Keycloak Filter</filter-name>
        <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>Keycloak Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <context-param>
        <param-name>keycloak.config.resolver</param-name>
        <param-value>com.example.demo.MultiTenantResolver</param-value>
    </context-param>

```

Custom Java resolver :

```auto
package com.example.demo;

import org.keycloak.adapters.KeycloakConfigResolver;
import org.keycloak.adapters.KeycloakDeployment;
import org.keycloak.adapters.KeycloakDeploymentBuilder;
import org.keycloak.adapters.OIDCHttpFacade;

public class MultiTenantResolver implements KeycloakConfigResolver {

    @Override
    public KeycloakDeployment resolve(OIDCHttpFacade.Request request)
    {
        var url = request.getRelativePath();
        if (url.contains("development")) {
            return KeycloakDeploymentBuilder.build(getClass().getResourceAsStream("/keycloak/development.json"));
        }
        return KeycloakDeploymentBuilder.build(getClass().getResourceAsStream("/keycloak/production.json"));
    }
}

```

---

<div class="post-metadata">

**Author:** ![pjmalandrino](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/pjmalandrino/32/6153_2.png) [@pjmalandrino](https://forum.keycloak.org/u/pjmalandrino)\
**Post date:** [January 24, 2023, 10:15am UTC](https://forum.keycloak.org/t/multi-tenancy-on-java-ee-aplication-not-working/19807/2 "2023-01-24T10:15:13Z")

</div>

Ok I am answering my own question ^^  
The following configuration worked like a charm for me :

```auto
<filter>
        <filter-name>Keycloak Filter</filter-name>
        <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
        <init-param>
            <param-name>keycloak.config.resolver</param-name>
            <param-value>com.example.demo.MultiTenantResolver</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>Keycloak Filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

```

It is not what is in documentation but I found it in code…