Repository navigation
Replies: 1 comment 1 reply
|
Hello! As you might assume, at the end of the day, how you deploy Keycloak will ultimately depend on your organization's needs and capabilities. That being said, here are some thoughts:
Have a great day! |
1 reply
|
Hi, thanks a lot for the answer! I had never heard about LDAP but I'll look into it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi everyone, this is a question that touches both Keycloak and system design, and I’m hoping to get some advices.
Context
I’m currently developing a microservices system for a platform that offers multiple products. Users of the platform can belong to multiple companies and use different products on behalf of those companies.
I’m planning to introduce SSO using Keycloak, but I’m undecided on some system design choices that involve Keycloak.
User Registration
I want to maintain a copy of each Keycloak user in my own database (assuming Keycloak's database and my database are separate, with their own data model).
To do this, my current plan is to handle registration and profile updates through custom APIs, e.g.:
POST /users/v1/register
PUT /users/v1/edit
These APIs would then forward the request to Keycloak's REST API to apply the requested changes.
This setup seems to work, but I'm wondering: is this a clean and recommended approach?
Would it be better to let users register directly through Keycloak and sync afterwards with a SPI? Or is handling it via custom APIs (with sync to Keycloak) acceptable in real-world setups?
User ID (JWT sub)
By default, Keycloak uses the user’s internal ID as the sub claim in the JWT.
However, since I'm storing the user in my own database, I’d prefer the sub claim to contain my own system’s user ID instead of Keycloak's one.
I was thinking about adding a custom user attribute in Keycloak (e.g., system_id) and then customize the JWT to set sub to this value.
Does this make sense?
Is using a custom attribute like system_id for the sub a good practice, or is there a better way to align identities between Keycloak and an external user system?
User Claims and Permissions
I’ll be working with a complex permission model. I’m undecided between two options:
What’s the best practice in this case?
Thanks in advance for your help!
Any insight would be greatly appreciated.
All reactions