You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Mandatory (email) domain in organizations and SaaS apps
#38865
Let me start out by saying I really like the new organizations feature in Keycloak!
Currently the email domain in organizations is mandatory and must be unique. This was briefly touched upon in the Organization/tenants within a realm discussion. When this requirement is put in the context of SaaS apps and also how organizations will evolve (as envisioned in #30180) I thought it would be worthwhile to discuss if this hard email domain requirement isn’t overly restrictive for the SaaS app use-case.
I fully understand the benefit of having an option to be able to specify an email address domain for an organization and use that for things such as “IdP routing” outside the context of SaaS apps. I also understand the design for organizations is easier if one mandates a unique email address domain per organization. However I think this requirement severely limits the SaaS application integration use-case for Keycloak.
For example;
If some department in some country within a company “registers” an organization with a domain (for example @ibm.com) this would then be the only organization which is allowed to exist within Keycloak for this company. If some other department in some other country of the same company wants to register this would be a problem. Since the domain is already “claimed”.
Some “organizations” might be groups of people which don’t have an email address domain in common.
It will require manual maintenance. For example there will always be "Organizations" which are orphaned and "block" domains from being (re)used.
As far as I can tell making a SaaS application and integrating Keycloak organizations is going to be hard with the above restrictions. I’m guessing that's also why the Phase 2 multi-tenant extension does not make email domains mandatory and took on the extra work of integrating the home IdP discovery extension instead.
I was wondering how you folks look at Keycloak organizations and the SaaS integration use-case.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Let me start out by saying I really like the new organizations feature in Keycloak!
Currently the email domain in organizations is mandatory and must be unique. This was briefly touched upon in the Organization/tenants within a realm discussion. When this requirement is put in the context of SaaS apps and also how organizations will evolve (as envisioned in #30180) I thought it would be worthwhile to discuss if this hard email domain requirement isn’t overly restrictive for the SaaS app use-case.
I fully understand the benefit of having an option to be able to specify an email address domain for an organization and use that for things such as “IdP routing” outside the context of SaaS apps. I also understand the design for organizations is easier if one mandates a unique email address domain per organization. However I think this requirement severely limits the SaaS application integration use-case for Keycloak.
For example;
As far as I can tell making a SaaS application and integrating Keycloak organizations is going to be hard with the above restrictions. I’m guessing that's also why the Phase 2 multi-tenant extension does not make email domains mandatory and took on the extra work of integrating the home IdP discovery extension instead.
I was wondering how you folks look at Keycloak organizations and the SaaS integration use-case.
All reactions