Identity
Keymate Identity is user identity management for your customers and partners: their users, profiles and organizations. Each customer gets its own organization and administrators on one installation. Your LDAP or Active Directory stays where it is.
Running identity for your customers on one installation
Serving many customers usually means one installation per customer, or a ticket every time a customer adds someone. Organizations remove the need for one installation per customer. Delegated administration lets each customer add its own people without a ticket.
Users and profiles
Every account in one console, with the fields your applications need, such as department, region or customer number. Policies can use these fields, along with groups and roles.
Organizations and multi-tenancy
Each customer is an organization inside one shared installation, with its own members, administrators and identity providers. Organizations can be nested, so a customer's departments get their own boundary.
Organization login.
Each organization signs in its own way: one through its corporate single sign-on, another with a username and password.
Organization context in every session.
A user in several organizations can switch between them. The active organization is carried in every token, so applications and policies know which customer's data is in play.
How to choose between organizations and a realm per tenant is covered in the multi-tenancy deep dive.
Delegated administration
A customer's or partner's own administrator manages the users and roles of their organization, and nothing outside it. You set the limits once: which roles they may hand out and which settings they may change. Their changes go into the same admin event log as yours.
User federation: LDAP and Active Directory
With Keycloak LDAP federation, Keymate signs users in against the LDAP directory or Active Directory you already run. The directory stays the source of each account and checks the password; Keymate keeps a synchronized copy of the user record, never the password.
If you sign in through Active Directory Federation Services (AD FS), Keymate connects to it over SAML or OpenID Connect like any other identity provider, and the directory behind it is untouched.
SCIM provisioning (on the roadmap)
SCIM is the standard API one system uses to create, update and remove user accounts in another. SCIM 2.0 provisioning is on the roadmap for Keymate. Today, accounts change through Keymate's API, with a connector for the system that owns your user list: an HR system, a directory or an identity provider.
Custom identity connectors
When a login or a user source does not speak a standard protocol, such as a national e-government login or an older IAM product, Keymate connects it through a custom identity connector on its extension points. The rest of the platform treats those users like any other.
How Identity connects to the rest of the platform
- Authentication checks that a user is who they claim to be, and how strongly: one factor, or more when the action demands it.
- Authorization decides what they may do, using the profile attributes and organization context Identity holds.
- Parallel Run moves users from the system you run today, one group at a time.
- Identity Governance: joiners, movers and leavers driven by events from your HR system, available today, and periodic reviews of who still needs access, on the roadmap.
Further reading
- Multi-tenancy and delegated administration: why tenants, org trees and scopes belong outside role names, and how to delegate administration by scope instead of cloning roles for every tenant.
- What is Keycloak: a developer's introduction to Keycloak, including realms, identity providers and LDAP or Active Directory federation.
Questions
What is the best way to do multi-tenancy in Keycloak?
For most platforms that serve many customers, organizations inside one realm: they share one configuration and keep members apart. A realm per tenant separates everything but multiplies configuration with every customer. Keymate adds nesting, delegated administration per organization and an active organization carried in every token. The multi-tenancy deep dive compares both.
Can customers manage their own users in Keycloak?
Yes. Keymate's Keycloak build adds delegated administration: a customer's administrator manages their own organization's users and roles, inside limits you set, such as which roles they may hand out. More under Delegated administration.
Do we have to move users out of LDAP or Active Directory?
No. With user federation, accounts stay in your directory and users sign in with their directory passwords, which are checked by the directory itself. Keymate keeps a synchronized copy of each user record, so you can add attributes the directory does not hold.
Does Keymate work with Active Directory Federation Services?
Yes. Keymate connects to AD FS over SAML or OpenID Connect as an external identity provider, so people keep signing in the way they do today.
What is SCIM, and does Keymate support it?
SCIM is the standard API for creating, updating and removing user accounts between systems. SCIM 2.0 provisioning is on the roadmap for Keymate. Today, the system that owns your user list keeps Keymate up to date through Keymate's API and a connector set up for that system.