Repository navigation
Organizations, shared identity providers? #37821
Replies: 1 comment 2 replies
|
For #2, I think you could use a single client in something like Microsoft Entra ID (probably same for Google) and just create multiple instances of IDPs so they are unique within Keycloak so that the associations are tied to the "IDP in Keycloak" - i.e., it's not tied by like the client id or Issuer from external provider. E.g., So long as all the account linking and everything is proper, seems like it'd be ok. Have you tried it yet? |
|
Yes, so I'm able to setup Microsoft multiple times, and then tie some to individual organizations and leave one open for public use. It just increases complexity of onboarding a little bit for our most common scenario, which is restricting to google or microsoft. The only reference I have that a certain organization may want to restrict google though is the organizations in keycloak, my external application does not track that in order to send idp_hint |
|
One other thing with this, for users that are already linked to our 'public' google provider, or used that solely for login initially, it also is confusing for them because they are already using their google account, but we need to say to link it to their google account a different way since its 2 different identity providers within keycloak |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I have a few different scenarios I need to support:
Some customers want to use their own private SAML. For this it looks like I can add it as an identity provider, then tie it as the only identity provider for an organization. This makes it unavailable to other organizations, which in this case would be good, because I would not want to accidentally tie that provider to another customer organization.
For social (Google/Microsoft) , I want to allow any user to login with their social account. Some customers (organizations) , want me to require that their users login with a specific social provider, such as Microsoft. So I thought I could setup Microsoft as an identity provider, then link it to that organization, but it removes Microsoft as an option for non organization users and for other organizations.
For 2, do I need to be adding several instances of say the Microsoft provider to support requiring a specific identity provider for some organizations? I'm not sure how many client ids/secrets I will be able to generate for some of the social providers, so I'm not sure how to mandate certain providers for some organizations, without it being removed for use with other organizations or for users who are not part of any organization
Edit:
Opened a feature request at #38125
All reactions