In our project, we want to connect keycloak with a single federal saml idp. This idp hosts the accounts for about 1000 departments. In Keycloak we want to create 1000 Realms representating the departments and make them communicate with federal IDP, that later a realm/department admin can administrate its users. Keycloak itself should look like a single SP for the IDP, so there should be only one SP-Metadata.
As far as i fugered out, keycloak does not support this approach. So i was thinking i could create a “Supplier” Realm that registers its SP-Metadata to the central IDP, and this realm becomes the IDP for the other departments.
Has anyone ever tried something like this, is it possible? Is there an even simpler solution to do this?