# MultiTenecy between the realms

**URL:** <https://forum.keycloak.org/t/multitenecy-between-the-realms/16559>\
**Category:** Miscellanaeous\
**Created:** [July 21, 2022, 7:19am UTC](https://forum.keycloak.org/t/multitenecy-between-the-realms/16559 "2022-07-21T07:19:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anurag](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anurag](https://forum.keycloak.org/u/anurag)\
**Post date:** [July 21, 2022, 7:19am UTC](https://forum.keycloak.org/t/multitenecy-between-the-realms/16559/1 "2022-07-21T07:19:26Z")

</div>

Hi there,  
I want to integrate 2 different realms with a single spring-boot application and want the user of second realm to have the access for first realm… and can I do this from the application,properties file.  
Any help would be great

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [July 21, 2022, 7:57am UTC](https://forum.keycloak.org/t/multitenecy-between-the-realms/16559/2 "2022-07-21T07:57:47Z")

</div>

> [@Inheritance mechanism between realms](http://forum.keycloak.org/t/inheritance-mechanism-between-realms/16518/2):
>
> There’s no inheritance. Realms are the level of isolation. Think about that each realm is a separate IdP. Master realm is a “special” realm, for administration purposes (of all other realms) only.

---

<div class="post-metadata">

**Author:** ![ch4mpy](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ch4mpy/32/5452_2.png) [@ch4mpy](https://forum.keycloak.org/u/ch4mpy)\
**Post date:** [July 28, 2022, 6:10am UTC](https://forum.keycloak.org/t/multitenecy-between-the-realms/16559/3 "2022-07-28T06:10:24Z")

</div>

I’m not sure I understand perfectly your question, but I think you can. I wrote spring-boot resource servers with users identified by two (or more) keycloak instances / realms.

What do you mean by “access for first realm”? As I see it, your 2 Keycloak realms are just identity providers. On the resource-server, what maters is the user identity. Who issued / certified this identity is of little importance (as long as it’s an authorization-server you trust).

To configure multi-tenant JWT security in spring, you should configure a `JwtIssuerAuthenticationManagerResolver` in your web security conf.

To do so from `application.properties` only, you can use [`spring-security-oauth2-webmvc-addons`](https://github.com/ch4mpy/spring-addons/tree/master/webmvc/spring-security-oauth2-webmvc-addons) or [`spring-security-oauth2-webflux-addons`](https://github.com/ch4mpy/spring-addons/tree/master/webflux/spring-security-oauth2-webflux-addons) instead of keycloak spring adapter (which are deprecated) or spring-boot-starter-oauth2-resource-server

---

<div class="post-metadata">

**Author:** ![ch4mpy](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ch4mpy/32/5452_2.png) [@ch4mpy](https://forum.keycloak.org/u/ch4mpy)\
**Post date:** [July 28, 2022, 6:20am UTC](https://forum.keycloak.org/t/multitenecy-between-the-realms/16559/4 "2022-07-28T06:20:52Z")

</div>

I wrote spring-boot resource-servers, each accepting identities issued by several Keycloak instances / realms. In those apps, security rules are based on users indentity (and roles and more). The access-token issuer is of little importance (as long as it is one of the configured “trusted” issuers).

For multi-tenancy, you should define a `JwtIssuerAuthenticationManagerResolver` (or `ReactiveAuthenticationManagerResolver`) in your web security conf. Sample here: [spring-addons/ServletSecurityBeans.java at ffefd695b1fc7f36cc7d74c071940b960047c159 · ch4mpy/spring-addons · GitHub](https://github.com/ch4mpy/spring-addons/blob/ffefd695b1fc7f36cc7d74c071940b960047c159/webmvc/spring-security-oauth2-webmvc-addons/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ServletSecurityBeans.java#L159)

This sample is taken from a lib that makes it super easy to configure spring-boot OpenID resource-servers: **configure your two identity providers from properties only like you requested**. Sample there: [spring-addons/samples/tutorials/resource-server\_with\_oauthentication at master · ch4mpy/spring-addons · GitHub](https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials/resource-server_with_oauthentication)