Is it possible to have multiple of same Identity Provider in one realm? #15172

canilsenlogiq · 2022-10-26T13:46:22Z

canilsenlogiq
Oct 26, 2022

Hello.

Is it possible to have multiple of same Identity Provider setup in one realm?
After adding a Microsoft IdP on one of our realms, I see that the Microsoft option have disappeared from the "Add Provider" dropdown list.

If not, is there a workaround or another solution? We have multiple customers that want to our portal to be integrated with their own AD solution.

Thanks for reading.

kkcmadhu · 2022-10-26T14:20:42Z

kkcmadhu
Oct 26, 2022

you can add multiple oauth/openid providers, not sure about micorsoft AD

2 replies

canilsenlogiq Oct 27, 2022
Author

Thank you for your comment, I will try to add Azure AD as a OpenID Connect v1.0 IdP and see how that works out.

canilsenlogiq Oct 28, 2022
Author

I tried OpenID Connect v1.0 as you suggested, and I could create multiple IdP connecting to different Microsoft/Azure ADs.
However, this will create multiple "Sign in with" boxes/buttons on the login form. Meaning if we have lot's of customers that have their own Microsoft AD, we would end up with tons of buttons on the login screen. The goal is to have one button for Microsoft alone.

Do you have any thought/tips?

kkcmadhu · 2022-10-28T10:43:23Z

kkcmadhu
Oct 28, 2022

i would recommend, having one realm per customer...

7 replies

Shaijil Aug 7, 2024

@canilsenlogiq

I am in a similar situation, My goal is to allow users from different Azure AD organizations to access my application using their respective enterprise account.
Kindly let me know if you have any update/recommendation in this regard.
Thanks for reading.

canilsenlogiq Aug 12, 2024
Author

@Shaijil
The way we ended up doing it was having only one Microsoft IdP setup towards our own Azure AD. Then we send out guest invites to external users from other ADs to join our Azure AD. It has worked great so far, but have obvious drawbacks such as:

Need to have your own AD.
Have to invite one and one user, so if ever a company with thousands of users needs to join, it will be tons of work.
The customer cannot control any access except kicking the user out of their own AD(That I know of).

Personally I think setting up multiple OpenID Connect IdPs, and creating an URL for each organization that forwards/maps with the kc_idp_hint query param is also a good solution.

Shaijil Aug 12, 2024

@canilsenlogiq
Thanks for sharing your experience and insights. It's helpful to understand the different approaches you've explored.
I agree that inviting individual users is quite difficult, especially for large organizations. The option to invite/sync entire domains would be ideal. I figured Azure has option for bulk upload though.

the-corner-guy May 28, 2025

@Shaijil The way we ended up doing it was having only one Microsoft IdP setup towards our own Azure AD. Then we send out guest invites to external users from other ADs to join our Azure AD. It has worked great so far, but have obvious drawbacks such as:

Need to have your own AD.

Have to invite one and one user, so if ever a company with thousands of users needs to join, it will be tons of work.

The customer cannot control any access except kicking the user out of their own AD(That I know of).

Personally I think setting up multiple OpenID Connect IdPs, and creating a URL for each organization that forwards/maps with the kc_idp_hint query param is also a good solution.

@canilsenlogiq
How was your setup, one realm per customer, or all customers go to the same realm

I have a similar use case, but this is only possible if all users go to the same realm, and if I have to maintain multi-tenancy due to security reasons what are my options

canilsenlogiq Jun 2, 2025
Author

@Shaijil ... snip ...

@canilsenlogiq How was your setup, one realm per customer, or all customers go to the same realm

I have a similar use case, but this is only possible if all users go to the same realm, and if I have to maintain multi-tenancy due to security reasons what are my options

We have one realm for all customers. Our realm has one Microsoft IdP which pairs to our own Azure AD. I'm not an admin for our Azure AD, so I don't know the AD details. But the way I understand it, is that we invite other emails to join our AD as guests. Then they can login with the Or sign in with "Microsoft" button on the same basis as our company users already in the AD.

danielFesenmeyer · 2024-08-07T19:10:18Z

danielFesenmeyer
Aug 7, 2024

Afaik, you can have only one IDP instance for each "Social Provider" (like Google, Microsoft etc).
But you can create multiple standard openid IDP instances. However, note that Azure AD (Entra ID) has some behavior which is not supported by the standard OpenId provider (see e.g. #26192)

0 replies

Is it possible to have multiple of same Identity Provider in one realm? #15172

Uh oh!

canilsenlogiq Oct 26, 2022

Replies: 3 comments · 9 replies

Uh oh!

kkcmadhu Oct 26, 2022

Uh oh!

canilsenlogiq Oct 27, 2022 Author

Uh oh!

canilsenlogiq Oct 28, 2022 Author

Uh oh!

kkcmadhu Oct 28, 2022

Uh oh!

Shaijil Aug 7, 2024

Uh oh!

Uh oh!

canilsenlogiq Aug 12, 2024 Author

Uh oh!

Shaijil Aug 12, 2024

Uh oh!

the-corner-guy May 28, 2025

Uh oh!

canilsenlogiq Jun 2, 2025 Author

Uh oh!

danielFesenmeyer Aug 7, 2024

canilsenlogiq
Oct 26, 2022

Replies: 3 comments 9 replies

kkcmadhu
Oct 26, 2022

canilsenlogiq Oct 27, 2022
Author

canilsenlogiq Oct 28, 2022
Author

kkcmadhu
Oct 28, 2022

canilsenlogiq Aug 12, 2024
Author

canilsenlogiq Jun 2, 2025
Author

danielFesenmeyer
Aug 7, 2024