3 ms·

> Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as

by piaste 4y ago

> Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as well as self service federation. (See also: https://zitadel.com/blog/zitadel-vs-keycloak https://zitadel.com/blog/zitadel-vs-keycloak) I might be misreading your post and/or the linked blog post, but I got the impression that both assume that different business customers will share the same KC realm and will only be divided by groups/roles/etc. Is that correct? We use Keycloak in a multi-tenant scenario, so each new business customer spawns its own realm, meaning it can have a fully independent configuration (SSO, OAuth2 integration, 2FA, roles, etc.). While we provide a simplified UI in our product, a sufficiently technical customer can in principle be granted a realm-level administrator user to manage their own configuration.

ffo 4y ago
From the IAM perspective (If the service is an IAM) I agree. But as SaaS provider I don’t want to use multiple realms because in that case my client would need to understand multiple issuers. Also Keycloak has a cutoff of around 400 ish realms last time I checked ;-)
- X-Istence 4y ago
  Do you have a source for the cut-off at around 400 realms?
  - ffo 4y ago
    Only my own experience and secondary sources https://keycloak.discourse.group/t/maximum-limit-of-realms/8189 https://keycloak.discourse.group/t/maximum-limit-of-realms/8... https://stackoverflow.com/questions/54465114/when-realm-count-reaches-around-470-keycloak-basically-becomes-unstable https://stackoverflow.com/questions/54465114/when-realm-coun...
- mooreds 4y ago
  Here's more about realms and keycloak from a different HN comment thread I participated in: https://news.ycombinator.com/item?id=31266603 https://news.ycombinator.com/item?id=31266603 I don't know abraae, but they seemed familiar with Keycloak.

by piaste 4y ago

ffo 4y ago

From the IAM perspective (If the service is an IAM) I agree. But as SaaS provider I don’t want to use multiple realms because in that case my client would need to understand multiple issuers. Also Keycloak has a cutoff of around 400 ish realms last time I checked ;-)

X-Istence 4y ago
Do you have a source for the cut-off at around 400 realms?
- ffo 4y ago
  Only my own experience and secondary sources https://keycloak.discourse.group/t/maximum-limit-of-realms/8189 https://keycloak.discourse.group/t/maximum-limit-of-realms/8... https://stackoverflow.com/questions/54465114/when-realm-count-reaches-around-470-keycloak-basically-becomes-unstable https://stackoverflow.com/questions/54465114/when-realm-coun...
mooreds 4y ago
Here's more about realms and keycloak from a different HN comment thread I participated in: https://news.ycombinator.com/item?id=31266603 https://news.ycombinator.com/item?id=31266603 I don't know abraae, but they seemed familiar with Keycloak.