You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Support for multiple credentials per client with federated client authentication (Signed JWT - Federated)
#52440
Allow configuring multiple pairs of IdP and federated subject per client so that the client can be used with assertions from multiple sources (for example, from multiple Kubernetes clusters).
Something like:
Currently in Keycloak, one client is basically bound to one cluster, IdP or issuer. There are several scenarios where this can be problematic:
Migrations where one app or service is deployed for some time to multiple clusters at the same time
General blue/green deployments across multiple clusters
Multi region deployments with clusters in different regions where the same service is deployed
Probably more...
Basically, this can be solved by creating multiple clients in Keycloak. But this makes the management more complicated:
Every deployment must be configured with the correct client ID
When clients have role assignments, the same role must be assigned to multiple clients to make sure the service has consistent permissions across all its deployments
The same is true for client scopes and client roles (if used). They must be configured consistently across all clients for the service
We see this especially in migration scenarios where the same service is deployed to a Kubernetes cluster on premises and in the cloud at the same time. Both deployments should use a Kubernetes service account, and they need the same permissions, client scopes and so on. This would require creating multiple clients and managing permissions and configuration for both clients. It would be better to have one client with two credentials configured, as shown above.
For Azure Workload Identity, for exmpale, it is possible to create up to 20 federated identity credentials per managed identity (which is basically the client in Azure terms):
This allows using the same client or managed identity from multiple clusters or deployments at the same time. The permissions of the client must only be managed once, and the client ID stays the same for the service, regardless of the deployment location or target.
So, I think it would be great if something similar were possible in Keycloak as well.
I would really appreciate your thoughts/feedback on this! Thx!
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Allow configuring multiple pairs of IdP and federated subject per client so that the client can be used with assertions from multiple sources (for example, from multiple Kubernetes clusters).
Something like:
Currently in Keycloak, one client is basically bound to one cluster, IdP or issuer. There are several scenarios where this can be problematic:
Basically, this can be solved by creating multiple clients in Keycloak. But this makes the management more complicated:
We see this especially in migration scenarios where the same service is deployed to a Kubernetes cluster on premises and in the cloud at the same time. Both deployments should use a Kubernetes service account, and they need the same permissions, client scopes and so on. This would require creating multiple clients and managing permissions and configuration for both clients. It would be better to have one client with two credentials configured, as shown above.
For Azure Workload Identity, for exmpale, it is possible to create up to 20 federated identity credentials per managed identity (which is basically the client in Azure terms):
This allows using the same client or managed identity from multiple clusters or deployments at the same time. The permissions of the client must only be managed once, and the client ID stays the same for the service, regardless of the deployment location or target.
So, I think it would be great if something similar were possible in Keycloak as well.
I would really appreciate your thoughts/feedback on this! Thx!
All reactions