Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesUse separate Keycloak realms when tenants need independent identity and administration boundaries; use one realm with Keycloak Organizations when they can share realm-level configuration but need tenant-specific membership and identity context. Either design still requires your .NET application to resolve the tenant, trust only its configured identity provider, and enforce tenant-scoped access to application data.
Should you use separate Keycloak realms or Organizations?
Choose based on the boundary you need. A realm is an isolated Keycloak identity domain. Organizations represent third parties inside a realm, allowing them to share realm-level configuration while carrying organization-specific membership and login context.
| Design consideration | Separate realms | One realm with Organizations |
|---|---|---|
| Identity and administration boundary | Keycloak realms are isolated and manage and authenticate the users they control. Separate realms suit tenants that need distinct identity populations or stronger administrative separation. | Tenants remain within a shared realm. Organizations model third parties and their memberships inside that realm. |
| Authentication and identity providers | Separate realm-level configuration can suit tenants that need different realm settings. | Organizations support organization-linked identity providers and organization-specific authentication context. |
| Tenant context for the application | The realm-specific issuer identifies the identity domain, but the application must still authorize access to tenant resources. | Organization claims can convey membership context, but the application must use that context in authorization and data access. |
| Operational and application work | Configure and maintain each realm, and map each tenant to the correct realm-specific authentication configuration. | Share realm configuration, but consistently select and enforce the correct organization context for each tenant operation. |
This is an architectural comparison, not a performance or cost ranking. The official guidance cited here does not establish comparative scale, cost, or performance figures.
Choose separate realms when isolation is the priority
Keycloak’s administration guidance says realm selection should reflect the isolation desired for users and applications. Separate realms are a reasonable fit when tenants need independent identity administration or different realm-level settings. The trade-off is repeated configuration and lifecycle work: realm-specific clients, identity-provider settings, and other realm configuration must be managed for each realm.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
Choose Organizations when tenants can share realm configuration
Keycloak Organizations model third parties within a realm. Their features include members, groups, invitations, identity brokering, organization-specific authentication steps, and organization claims that applications can use for authorization. This is a membership and context model, not a database-isolation feature: your .NET application remains responsible for limiting each user to the correct tenant’s records and operations.
How does tenant routing connect to token validation?
Each Keycloak realm has its own OpenID Connect discovery document, at /realms/{realm-name}/.well-known/openid-configuration. The document describes that realm’s authorization, token, user-info, and signing-certificate endpoints. In a multi-realm application, tenant resolution therefore determines which configured issuer and validation settings are appropriate; it must not turn an untrusted request value into permission to trust a new issuer.
- Resolve the tenant from a controlled source. Use an application-managed host-to-tenant mapping or a trusted, authenticated application flow. Treat a caller-supplied tenant name as input to validate, not as proof of identity or authorization.
- Map the tenant to an allowlisted identity configuration. Keep the tenant-to-realm mapping in trusted application configuration or another controlled source. Do not fetch discovery metadata for an arbitrary issuer supplied by a caller or accept an arbitrary token
issas permission to do so. - Select the corresponding authentication handler. Validate the token against the configured realm’s issuer, signing keys, and expected audience, then apply the application’s tenant authorization rules.
- Carry tenant context through resource access. Check that the authenticated user is entitled to act in the resolved tenant before reading or changing tenant-owned data.
The issuer helps identify an identity domain; it does not, on its own, establish that the identity may access every tenant or resource in your application.
How do you configure multiple authentication schemes in ASP.NET Core?
ASP.NET Core provides authentication building blocks rather than an automatic multi-tenant policy. Microsoft’s ASP.NET Core 10.0 authentication guidance states: “ASP.NET Core doesn’t have a built-in solution for multi-tenant authentication.” It documents multiple schemes and policy schemes for selecting handlers; your application must supply the tenant mapping and authorization rules.
Use named schemes for a small, known set of realms
Register a distinct named authentication scheme for each supported realm, with its authority and validation settings tied to that realm’s trusted configuration. Then bind the relevant authorization policies or endpoints to the intended scheme. This makes the supported issuers explicit and is practical when the realm set is limited and known to the application.
Use a controlled selector when scheme choice is dynamic
If requests may target many configured tenants, a policy scheme or another explicit selector can choose a handler based on the trusted tenant mapping. ASP.NET Core supports forwarding and selection mechanisms, including selection based on request or token properties. A selector is not an issuer allowlist by itself: the chosen handler must still validate the expected issuer and audience for that tenant, and the selector must not trust arbitrary caller-controlled values.
Use an appropriate tenant framework if it fits the application
Microsoft points to Orchard Core, ABP Framework, and Finbuckle.MultiTenant as framework options relevant to multi-tenant applications. Evaluate how a candidate handles tenant resolution and integrates with your authentication and authorization design; adopting one does not remove the need to define which realms or organizations each tenant may use.
How should an interactive .NET application sign users in?
For an interactive web application, Microsoft’s ASP.NET Core guidance recommends a confidential OpenID Connect client using the authorization-code flow and recommends PKCE. Configure redirect URIs and client credentials for the deployment and the relevant realm. With multiple realms, keep each realm’s client and authority configuration associated with the tenant mapping rather than constructing it from an untrusted request.
How do Organization claims affect authorization?
Keycloak can include organization claims when the optional built-in organization scope is requested. Supported scope forms are organization, organization:<alias>, and organization:*. The generic scope can prompt a user who belongs to multiple organizations to choose a context. The application should decide how that selected context relates to the already-resolved tenant and enforce that relationship in its authorization checks.
Do not treat a claim’s presence as proof that every requested resource belongs to that organization. Check the user’s organization context against the tenant for the current operation, and apply tenant scoping to database queries and other resource access. Organization membership supplies identity context; it does not automatically isolate application data or authorize every action.
What should you know about Organization Groups?
Keycloak announced Organization Groups for Keycloak 26.6.0 on April 29, 2026. Their hierarchical paths are scoped to each organization. The announcement says these groups appear in organization claim context but cannot be used in Keycloak authorization policies, unlike realm groups.
Because this behavior is version-specific, verify that the deployed Keycloak version supports the feature and test how the claims are emitted, mapped, and consumed by the .NET application before making Organization Groups part of an authorization design.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
How do you choose and verify the design?
- Choose separate realms if tenant identity populations or realm-level administration need separation, and plan how each realm’s configuration will be maintained.
- Choose Organizations if tenants can share realm-level configuration and the application needs Keycloak-managed organization membership or identity context.
- Document the trust map from tenant identifier to allowed realm or organization, issuer, client configuration, and expected audience.
- Test the boundaries by checking that a token from one realm cannot authenticate under another realm’s configuration, and that one tenant cannot access another tenant’s resources.
- Test organization selection for users who belong to multiple organizations, including the context the application receives and how it is checked against the requested tenant.
- Recheck version-dependent behavior before relying on Organization Groups or other features whose availability can change with the Keycloak release.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
