I am new to Keycloak and have been reading the documentation. There is a term realm that I understand as a unique user/client management instance. Realms cannot communicate. I am curious why anyone would have more than 1 realm besides master. What would the use case be? What is the reason to have other realms than just master?
1 Answers
I am curious why anyone would have more than 1 realm besides master.
From the Keycloak documentation itself one can read:
Master realm - This realm was created for you when you first started Keycloak. It contains the admin account you created at the first login. You use this realm only to create other realms.
A realm defines a cosmos for users, permissions and with the option to use it for one or multiple applications.
Now assume you want to have multiple applications in one organization, and each application needs its own permissions.
If you put them all into one realm, you would mess up your complete settings, since your permission naming will contain ALL applications. Also you will need to define an enterprise mandatory naming scheme of the permissions and parameters. This may work, but what would happen if your enterprise acquires a new company without such a naming scheme?
So with the structuring of the realms, your security team can freely decide between how many applications are under the hood of ONE realm or each application has its own realm.
Related