Keycloak - Is it possible share a common set of users between realms?

No that's not possible. Users are always realm specific. The only way would be to keep the users in an external store and integrate this external store via federation (UserStorageSpi) into both realms. But then you'll have to do all user management on the external store, as it is the primary source of your user data.


Agreed with accepted answer that it's not possible.

You could treat realms as 'user pools' - a user should belong to one or another (identity) unless they are truly treated as two separate identities.

Then you could create a third realm that's used for Client connections, so the app only has to integrate with a single auth server. This third realm could then federate to the other two realms via Keycloak OpenID Connect.

Using this method, you could also provide groups/roles/permissions depending on where they were federated. Clients integrated with this realm would then be accessible by everyone in either realm - may require further RBAC enhancements to determine true access.

EDIT: Also note that you can skip the 'hub' realm and federate directly to the desired user-pool realm via KC_IDP_HINT. For example, your app could be loaded via different subdomains - the app can decide the KC_IDP_HINT by which subdomain was used.