Keycloak multi-tenancy and organizations
One login platform for all your customer organisations.
Which of these sounds like your company?
Many business customers
Every customer needs its own users and rules.
Customers want their own SSO
Larger customers want to log in with their company account.
Manual onboarding
Setting up a new customer takes too much work.
Your app needs the tenant
Authorisation depends on knowing the customer.
Realm sprawl
One realm per customer is getting hard to manage.
User admin on your desk
Your team manages users on behalf of customers.
Don't see your challenge? Let's discuss your use case.
Book a call →How we work on your use case
Pick the challenge that matters most. We take it from there.
- 01
Design
the tenant model for your growth
- 02
Prove it
with a few real customers
- 03
Roll out
onboarding, SSO and roles
- 04
Scale
load-tested as tenants grow
Technical details
- Realm per customer, one realm with Keycloak Organizations, or groups, chosen by tenant count and isolation needs
- onboarding by invitation, company login or admin
- identity provider per organisation, matched by email domain
- roles per tenant and application
- organisation claims in access and ID tokens
- delegated administration for customer admins
Flexible to fit you
Realms, organizations or groups
Shared login, or the customer's own SSO
Self-service, or admin onboarding
Customer admins manage their own users
We run it, or hand it over to you
Measured on the KPIs you set
You choose what success means. We measure it from day one.
Time to onboard a customer
Tenants per instance
Login success rate
Support tickets per customer
FAQ
Realms isolate strongly but get hard to manage at scale. Organizations suit many tenants in one realm.
Yes. Each organisation can have its own identity provider.
Organisation details are added to the tokens your application receives.
It depends on the complexity and scope of your project. We discuss it in the first call.
