title: Keycloak multi-tenancy and bearer-only microservice
body: <p>I have some Spring Boot microservices with Spring Cloud API gateway (Zuul) in front of them.<br>
  API gateway authenticates users and forward the Authorization bearer token header.<br>
  Working fine with a single realm.</p>
  
  <p>Now, I'd like to use multiple realms.  </p>
  
  <p>Using <a href="https://www.keycloak.org/docs/latest/securing_apps/index.html#_multi_tenancy" rel="nofollow noreferrer">KeycloakConfigResolver</a>, I'm able to authenticate user with the API gateway (keycloak deployment based on path).  </p>
  
  <p>But how should I configure KeycloakConfigResolver for microservices (bearer-only) so the use the right KeycloakDeployment? As every service can be accessed by both realms I don't know how to detect against which realm user was authenticated?  </p>
  
  <p>I cannot use path for <code>KeycloakConfigResolver</code> as for example for the order-service, users can do a GET on <code>/orders</code> being authenticated by realm1 or realm2...</p>
  
  <p>Using header does not seem to be a good solution either....
  Any idea? </p>
  
  <p>I hope I'm clear enough...</p>