"We are sorry... Client not found." when trying to Sign In a new user to an existing organization

[Sefibrah]

I tried following this video from @dasniko :

#KEYCLOAK #Organizations - Multi Tenancy in 1 Realm | Niko Köbler (@dasniko)

But for some reason, I get this error message: “We are sorry… Client not found.”

Here’s how it looks like now (GIF below):

I am trying to set it all up locally to test my usecase, but for some reason, this is the same wall I keep hitting!

Here’s my IDP setup (images are downstairs):

My organization setup (images are downstairs):

So my question is: Does anyone see something wrong here? Ideally, maybe even Niko could respond

If you need more info, please let me know.

[Sefibrah]

Problem GIF:

Idp setup:

1. 
2. 
3. 

And my Org setup:

1. 
2. 

[Sefibrah]

Additionally, here’s my realm info:

[dasniko]

You’re doing brokering from your realm to your realm. Never did this before, don’t know it this is the cause. This also makes not sense IMHO.
Additionally - does your used client exist? You pasted a lot of random screenshots, but the important part of information is missing.

[Sefibrah]

I should’ve pointed out that this is my first time using Keycloak, so expect the unexpected from me

I guess it’s best to describe the goal I have in mind, so here’s the context first.

Context:

1. realm of rent-a-cars, but each rent a car is its own organization
2. realm of customers

The backend I have in mind is:

1. one NodeJs Strapi for the rent-a-cars realm (not setup yet)
2. one NodeJs Strapi for the customers realm (not setup yet)

The frontend I have in mind is:

1. one Angular for the rent-a-cars realm (not setup yet)
2. one Angular for the customers realm (not setup yet)

Goal:

I wish to combine these 3 frameworks i.e. Keycloak, NodeJs Strapi, and Angular, per realm.

Strategy - Strapi + Keycloak Phase:

Strapi says that I have to setup a Client in Keycloak, and hook up my Strapi to it. Source from docs: Keycloak provider setup for Users & Permissions | Strapi 5 Documentation

That seems understandable.

I noticed the flow in your video where the user would enter his email, and the linked Identity Provider would be used to route/link the user to the appropriate organization login screen, and thus, it would allow him to login through it. I like this, and I want to keep it.

Problem:

I don’t know if this behavior can be applied to the newly created Client, nor how. My hands are tied on the Strapi side, but on the Keycloak side, I have no idea how to do it.

Questions:

Question 1: I am not sure what the best approach is here but, but is it possible to have a setup like this:

1. Strapi connected with Keycloak through the aforementioned Client
2. Still have the routing/linking ability of the Identity Provider available in that client

Question 2: Do all of my organizations have to have a unique Identity Provider, or can they all share a general Identity provider, but have it point to different domains? I feel like you’re gonna say yes, but I just want that extra clarification if possible.

Additional note: I am experimenting with this idea, so you can probably see many holes in it. It’s also true that I haven’t setup anything besides the Keycloak on my local Docker container. It’s also true that I am a struggling beginner in Keycloak.

Any code/config samples (if applicable, or possible) will be highly appreciated!

Thank you for your time and patience!