Keycloak
Open-source Java-based IDP. Enterprise-grade self-hosted SSO + SAML, heavy to operate.
VISIT KEYCLOAKKey takeaway: When self-hosting is a policy rather than a preference and the requirements include real enterprise SSO, Keycloak is the serious answer. Nothing else open source matches its federation coverage or its track record in government and large enterprise. The price is operational: a JVM service, a database, upgrades, and someone who understands realms.
Quick facts
- CategorySelf-hosted
- LanguageJava
- PricingOpen source
- LicenseApache-2.0
- Created2014
- GitHub stars26.8k
- HIPAA-eligibleYes (BAA)
- SSO / SAMLOut of box
What it is
Keycloak is the open-source IDP backed by Red Hat. Enterprise-grade, SSO, SAML, OIDC, federation, fine-grained authorisation. Java-based, heavy to operate, complete. Used heavily in government, large enterprise, and self-hosted-by-policy environments.
Best for
- Government / public sector with self-hosted-only requirements
- Large enterprises with existing Java + Red Hat stack
- Multi-tenant SaaS that wants identity in their own infrastructure
When not to pick it
Skip Keycloak for small teams, operational overhead is real. Skip if you do not need self-hosted; SaaS will save engineering time.
My take
Keycloak is the right answer for serious self-hosted SSO. The operational cost is real and the JVM footprint is heavy. For small / mid-market teams, SaaS auth wins.
What running it actually involves
Keycloak is not a library you add to a project, it is an identity provider you operate. That means a JVM process sized properly, a relational database it owns, a caching layer configured for whatever clustering you need, TLS and reverse-proxy configuration that it is particular about, and a backup and restore plan covering realm configuration as well as user data. Upgrades deserve their own paragraph: major versions have historically changed defaults and admin console behaviour in ways that require reading release notes carefully rather than bumping a tag. In exchange you get a system that has survived very large deployments and every awkward federation scenario anyone has invented. If your organisation already runs JVM services and has platform engineers, this is ordinary work. If your team is three people shipping a product, it is a permanent tax that a hosted vendor removes entirely.
Federation depth and the alternatives
Keycloak's feature depth is why it persists. SAML and OIDC in both directions, LDAP and Active Directory user federation with configurable sync, identity brokering across multiple upstream providers, fine-grained authorisation services, per-realm isolation for multi-tenancy, and a theming system that lets you fully rebrand the login pages. Authentik covers most of the common ground with a lighter operational footprint and a friendlier admin experience, and for small to mid-market self-hosting it is usually the better trade. FusionAuth is the other lighter option if you can accept a source-available licence. Reach past both to Keycloak when you need LDAP federation against a real corporate directory, when a compliance regime expects a widely audited open-source identity provider, or when Red Hat's commercial backing is what gets the project approved internally.
Frequently asked questions
Is Keycloak free?
Yes. Keycloak is open source under Apache 2.0 with no licence cost and no user limits. Your cost is infrastructure and the engineering time to operate it, which for a production deployment with high availability is not trivial. Red Hat sells a supported build for organisations that want a vendor to call when it breaks.
Keycloak or Authentik?
Authentik for small to mid-market self-hosting: lighter to run, a more modern admin experience, and container operations rather than JVM tuning. Keycloak when you need deep LDAP and Active Directory federation, very large scale, or the reassurance of Red Hat backing and a long enterprise track record. Both are open source and both do SAML and OIDC properly.
Is Keycloak too heavy for a small team?
Usually, yes. Operating it well means a JVM service, a database, clustering, careful upgrades, and someone who genuinely understands realms and client configuration. Unless self-hosting is mandated by policy or compliance, a small team gets more done with a hosted provider and spends the saved time on the actual product.
Links
Compare Keycloak side-by-side
Similar tools you should also consider
FusionAuth
Self-hosted auth from a US team. Lighter than Keycloak, paid for support, free for self-hosting.
Read the take →Authentik
Modern open-source self-hosted IDP. Python-based, lighter than Keycloak.
Read the take →Ory
Cloud-native open-source identity stack, Kratos (auth), Hydra (OAuth2), Keto (authorisation).
Read the take →If Keycloak is your pick, the next conversation is short
The 30-min call is where your auth choice becomes a real architecture, a migration plan if you are switching, and a price range you can take to your stakeholders. Describe your stack, your scale, your compliance constraints. I tell you whether Keycloak is genuinely your fit.