Realms (Multi-Tenancy)

A Realm turns a single IdentityServerNET instance into a multi-tenant server. Each realm is an isolated tenant with its own administrator, its own clients, roles and resources — while still sharing one installation, one database and one set of global identity/API resources.

Tenant membership is domain-based: a realm owns one or more e-mail domains (e.g. acme.com), and any user whose e-mail address ends in one of those domains is automatically considered a member of that realm. There is no separate “assign user to realm” step and no suffix added to the user’s own account — membership is derived purely from the e-mail domain.

Realm-scoped entities — clients, roles and identity/API resources — do carry a namespace suffix, {name}@{realm} (e.g. a client my-app@acme). This keeps a realm’s clients and roles clearly separated from the global ones and from other realms’, while a global entity (no @realm suffix) remains usable, by default, only by users who do not belong to any realm — see Allowing Cross-Realm and Public Access to a Client for how a client can opt into accepting other realms’ users as well.

Note

Realms are an optional feature. An installation that never creates a realm behaves exactly like a classic single-tenant IdentityServerNET server.

Contents:

• Creating and Administering Realms
  • Creating a Realm
  • Realm Admin — Scoped Administration
  • Managing an Existing Realm
  • Naming Convention Reference
• Realm Appearance (Branding)
  • Application Title
  • Colors
  • Logo
  • Background Images
• Allowing Cross-Realm and Public Access to a Client
  • Configuring AllowedUserDomains
  • Where the Check Is Enforced