Large scale multi-tenanting scenarios with Keycloak

Peter_Coulton_117 0
Viewed 2495

I'm trying to understand how Keycloak can be used in a large scale multi-tenanted scenario.

The standard approach seems to be to use a realm for each tenant. This isolates each tenant's users and settings and makes a lot of sense.

In the Keycloak example for multi-tenanting it says it "demonstrates the simplest possible scenario for Keycloak Multi Tenancy support" (emphasis mine). I might be reading too much into this, but to me that implies there are other standard approaches. I haven't been able to find much discussion about these options though.

I've also read that there are potentially performance issues with more than 100 realms. It might be that these performance issues have been fixed, but this also suggests to me that Keycloak wouldn't handle a large scale multi-tenanting scenario with 1,000+ tenants.

So my questions are:

  • Are there any other recommended approaches for multi-tenanting, other than "one realm per tenant"?
  • Are there any large scale multi-tenanting deployments of Keycloak in the wild that demonstrate its ability to cope with lots of realms?
  • Are there any recommendations for sources of information that I should be looking at?
keycloak multi-tenant
1 Answers

To date (Keycloak 18 being released) the performance issues with 100+ realms still exists. But in the real world this is not an issue at all.

Just split your Tenants to multiple Keycloak clusters. I case you need to integrate your realms, this can be done independent from the specific cluster/instance through Federation across the clusters, so there's no need to run everything on a single cluster.

From an operations point of view - having such a large amount of tenants / realms on a single cluster would also be suboptimal - as you'd have a hard time to organize maintenances and downtimes. So splitting things up a bit is not the worst thing to consider.

user_1169320
Related