title: Keycloak support for one realm on a domain name while serving on multiple domains simultaneously
body: <p>I'm building an ecosystem of applications on kubernetes with keycloak as authentication/authorization provider. I am(or probably was) planning for everything to be integrated with it via OpenId(OAuth2) and for user credentials and other private information never to leave the keycloak instance in an unencrypted form.</p>
  
  <p>I was trying to implement the whole authentication scheme with the following configurations in mind.</p>
  
  <h2>Realms</h2>
  
  <pre><code>myservice: Realm containing the public and back-office users of my application. 
             All microservices that I have are authenticating users against this realm.
  
  master:    Contains admins, keycloak administrators and other resources which 
             should not be ever exposed to the public or intranet users. No microservice 
             ever performs authentication on this realm.
  </code></pre>
  
  <h2>Domains</h2>
  
  <pre><code> 1. domain: account.myservice.com
      access: public
      cors: allow requests from app.myservice.com
      config: kubernetes-ingress
      exposes: configured themes to support login, registration, etc.. Endpoints 
          for public front-end application token validation
      description: Only exposes access to a realm called "myservice" in keycloak. 
          No users from other realms can login or interact.
  
  2.  domain: account.internal.myservice.com
      access: intranet/admins
      cors: allow requests from back-office.internal.myservice.com
      config: kubernetes-ingress
      exposes: configured themes to support login, registration, etc.. Endpoints 
          for back-end front-end application token validation
      description: Exposes all the realms and provides access to keycloak 
          administrative UI.
  
  3.  domain: keycloak (keycloak.default.svc.cluster.local)
      access: cluster-internal
      cors: none
      config: kubernetes service, visible only inside the cluster
      exposes: endpoints for back-end application token validation
      description: Only exposes realm "myservice" and is used for other services to 
          validate user tokens and similar stuff.
  </code></pre>
  
  <p>I did come across a number of issues when trying to implement the above configuration scheme. If I do SSL termination inside Keycloak I won't be able to configure the different domains via a reverse proxy or similar approach which, in turn, means that Keycloak should provide a feature to listen on a separate SSL encrypted port and only make one realm available there. Which it does not. So do I want something weird here? Are the best practices different from what I want?</p>