Help needed with Multitenancy

[MihaStemberger]

Hello!

Pardon me for misuse of terms as all of this is new to me.

Environment:

• Keycloak 26.4.5
• WildFly apps (one deployment per “region”)
• Each WildFly deployment is configured to trust exactly one Keycloak realm

Within Keycloak, I have two "types" of realms. Realms that are meant to represent organizations, these contain users, and realms that aggregate various organization realms into region realms(these have identity provider configurations pointing to previously mentioned organization realms). Each Wildfly deployment then trusts a specified region realm.

The problem for me now is that Region A needs to make a call onto some Region B endpoint. This call will fail as the access token from Region A is not valid for Region B.

What are my options to solve this?

From what I have read up to this point I was under assumption that some kind of a token exchange will be needed.

First, I discovered that the external identity provider tokens may be stored and accessed , so I attempted to start here and use this token to exchange it for Region B token. What hit me then is that the stored external idp token may not be available if it does not get refreshed in time and runs out prior Region A token does. I did read Client initiated account linking section where it says, but at this point I am unsure this is correct path.

Refreshing external tokens
If you use the external token generated by logging into the provider (such as a Facebook or GitHub token), you can refresh this token by re-initiating the account linking API.

With that in mind I am currently stuck with the following idea: exchanging the Region A realm token for its organization token(done with internal to external token exchange) followed by token exchange between organization and Region B realm(external to internal exchange).

At this point I am unsure if this is even correct as after chatting with AI, it started to throw some silent login flows to me.

Thanks for reading!