Keycloak same username in multiple federations

Question

I have two user federations in one realm (different active directories). Because both are completely independent, in occurs that the same username is used.

In Microsoft Applications you can use something like "ad1\ttestuser" and "ad2\ttestuser". Is there a way I can configure Keycloak to choose the user federation on login? A solution would be to add a prefix to the username in the mapper but there is no way to do it.

Answer 1

Is there a way I can configure Keycloak to choose the user federation on login?

You could create a different realm per user federation that you want your users to be able to explicitly authentication against. Then you configure each user federation in its own realm. Finally, you configured those realms to do identity brokering against the original realm.

The login page would look something like:

You can have a look a this answer which describes this setup in more detail.