Incorporate comments of Paul

2204-Helmholtz-AAI-Punch+ERUM/2204-Helmholtz-AAI-Punch+ERUM.md

@@ -130,6 +130,22 @@ backgroundTransition: none
 - More docs at Helmholtz AAI:
   - [https://aai.helmholtz.de/doc](https://aai.helmholtz.de/doc)
 
+## Adanced example:<br/> Keycloak Infrastructure proxy
+- Use case:
+    - DESY operates the dCache storage infrastructure
+    - Local DESY users already possess data (Terabytes)
+    - Goal: Allow external users, while not touching existing internal ones
+- Solution
+    - **Yet Another Proxy!** (known as "Infrastructure Proxy")
+    - In this case: Keycloak
+        - Handle incoming users
+        - Check with local user-db
+        - Forward user to services (dCache is just the first one)
+- Result:
+    - Authorisation delegated to VO Managers
+    - Reuse existing infrastructure setup (no additional instance of dCache)
+    - A single infrastructure proxy allows connection of legacy site services
+
 ## Helmholtz AAI: Numbers {
     data-background-image="images/aai_users-plot_2.png" data-background-size="contain"
     data-transition="none-in zoom-out"