Repository navigation
Implementing Organization-Specific Policies for Users Shared Across Multiple Organizations in Keycloak #38441
Unanswered
AdityaZwing
asked this question in
Q&A
Replies: 1 comment
|
Hi @AdityaZwing, I am also looking to implement similar scenarios with Keycloak. Mostly, the ability to assign roles in the context of an organization. Did you manage to find any suitable solutions? |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
I'm exploring strategies to enforce organization-specific policies for users who are members of multiple organizations within a single Keycloak realm. The goal is to ensure that each organization can define distinct access controls, authentication requirements, and privileges for their shared users.
Current Understanding:
Keycloak's Organizations feature allows users to be associated with multiple organizations within a single realm. This facilitates multi-tenancy scenarios where users can operate across different organizational contexts. However, implementing organization-specific policies for such users presents certain challenges.
Challenges:
Role Assignments: Assigning roles that are specific to each organization to ensure users have appropriate permissions within each context.
Authentication Flows: Customizing authentication requirements, such as enforcing Time-based One-Time Password (TOTP) for certain organizations while not requiring it for others.
Access Control: Implementing attribute-based access control (ABAC) to enforce organization-specific policies based on user attributes and organizational membership.
Request for Insights:
I'm seeking guidance on best practices for implementing these solutions within Keycloak. Specifically:
Are there existing features or configurations in Keycloak that facilitate organization-specific policy enforcement for users with multiple organizational memberships?
What are the recommended approaches to manage authentication flows and access controls that vary between organizations?
Are there any known limitations or considerations to be aware of when implementing such configurations?
Any insights, experiences, or resources related to enforcing organization-specific policies for shared users in Keycloak would be greatly appreciated.
All reactions