I work for a multi company group. Each company has its own Network its own IT Admins and therfore its own Active-Directory. There is no possibility to connect the different Networks via VPN for e.g. The users of the companies can be identified from their email domain for e.g. jdoe@company-a.com and jdoe@company-b.com

My goal is to develop a global application for the whole company group.

I want to use Keycloak as Identity and Access Management.

The problem is that every user, which is member of defined groups, from all companies must have access / login / authorized to the centralized frontend and the decentralized backend (self programmed API proxy/gateway).

Here is a drawing of the current situation:

Draw.io Feel free to edit

Suggestion:

1. I would use a shared DB for the keycloak instances, but since there is no VPN it cant be done
2. keycloak to keycloak user federation ?
3. Use the other companies as idP and script a switch to the main keycloak?

Thanks in advance for your help :)