Tools · SPBoucher
Menu

Keycloak

by Keycloak project (CNCF incubating, originated at Red Hat) · Application · also known as Red Hat build of Keycloak, RH-SSO

Open-source identity and access management server providing single sign-on with OpenID Connect, OAuth 2.0 and SAML, user federation and fine-grained authorization

Apache-2.0 licenseOpen sourceFreeSelf-hostedSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

Keycloak is an identity and access management server, licensed under Apache-2.0 and an incubating project of the Cloud Native Computing Foundation after originating at Red Hat. It acts as an OpenID Connect, OAuth 2.0 and SAML 2.0 identity provider for applications, offering login pages, single sign-on and sign-out, social and enterprise identity brokering, user federation with LDAP and Active Directory, multi-factor authentication including WebAuthn passkeys, and an authorization-services component for policy-based permissions. Realms isolate tenants, and an admin console and REST API manage clients, users, roles and themes.

It runs on Quarkus as a Java application, typically in a container with PostgreSQL or another relational database, and is a standard choice when an organization wants to own its identity provider rather than rent one. Red Hat sells a supported build for enterprise customers.

Keycloak is comparatively heavy: memory use, clustering configuration and frequent major releases demand attention, and customizing flows or themes involves Java development.

Capabilities

  • OpenID Connect, OAuth 2.0 and SAML 2.0 identity provider
  • Single sign-on across applications with session management
  • User federation with LDAP and Active Directory and identity brokering with social or enterprise IdPs
  • Multi-factor authentication including WebAuthn passkeys and OTP
  • Authorization services for policy-based permissions
  • Admin console, REST API and customizable themes and flows

Typical workflows

  1. Protect internal web applications with SSO and a reverse-proxy OIDC adapter
  2. Federate an existing LDAP directory into modern OIDC logins
  3. Issue tokens to APIs and mobile apps

Strengths

  • Full-featured, standards-based and Apache-2.0
  • Active community with CNCF governance
  • Supported commercial build available from Red Hat

Limitations

  • Resource-heavy Java application with involved clustering
  • Frequent major releases require upgrade planning
  • Customization often requires Java extensions

Prerequisites

  • Java runtime or container
  • Relational database such as PostgreSQL

Who it is for

  • Platform and security engineers
  • Organizations self-hosting identity

Alternatives & comparison

authentik covers a similar protocol set with a Python and Go stack, a built-in application proxy and a lighter footprint, but reserves some features for its enterprise edition. Supabase Auth is an application-embedded authentication service rather than an organization-wide identity provider.

  • authentik

    Self-hosted identity provider with OIDC, SAML, LDAP, RADIUS and SCIM support and a built-in application proxy, with an MIT core and an enterprise edition

    MixedOpen source
  • Supabase

    Open-source backend platform built around a dedicated PostgreSQL database with auto-generated APIs, authentication, file storage, realtime subscriptions and edge functions

    Open sourceOpen source
  • Web Authentication (WebAuthn)

    W3C standard defining the browser API for creating and using public-key credentials, the basis of passkeys and FIDO2 hardware-key authentication

    Open sourceFree
Compare Keycloak with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    Keycloak LICENSE (Apache-2.0)

    https://github.com/keycloak/keycloak/blob/main/LICENSE.txt

    Supports: license_spdx, source_model

    checked Nov 1, 2026
  • Official documentation
    Keycloak Documentation

    https://www.keycloak.org/documentation

    Supports: capabilities, prerequisites

    checked Nov 1, 2026
  • Official site
    Keycloak

    https://www.keycloak.org/

    Supports: name, summary, vendor, capabilities

    Footer states Keycloak is a Cloud Native Computing Foundation incubation project.

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

1Password

AgileBits Inc. (1Password) · Secrets management

In-depth entry

Password and secrets manager for individuals, families and businesses with end-to-end encrypted vaults, passkeys, an SSH agent and a developer CLI

ProprietaryPaidEnterpriseLocalNov 2, 2026

Web Authentication (WebAuthn)

W3C Web Authentication Working Group (with the FIDO Alliance) · Identity & access

W3C standard defining the browser API for creating and using public-key credentials, the basis of passkeys and FIDO2 hardware-key authentication

Open sourceFreeLocalBroken

Bitwarden

Bitwarden Inc. · Secrets management

Open-source password manager with hosted and self-hosted server options, passkey support, organization sharing and a separate Secrets Manager for developers

AGPL-3.0-onlyFreemiumPaidLocalSelf-hostedNov 2, 2026