Keycloak

What is Keycloak?

Keycloak is an open source identity and access management (IAM) platform that adds authentication and authorization to your applications so you don’t build login yourself. It provides single sign-on, social login, user federation, and fine-grained access control over standard protocols — OpenID Connect, OAuth 2.0, and SAML 2.0. It’s a Cloud Native Computing Foundation (CNCF) project, licensed Apache-2.0.

What is Keycloak best for?

Keycloak fits teams that want a full-featured, standards-based identity provider they run themselves — no per-active-user billing and no sending user data to a third-party cloud. It’s a strong fit for organizations that need SSO across many internal apps, LDAP/Active Directory federation, and enterprise SAML, and that have the engineering capacity to operate a Java service in production.

What can Keycloak do?

• Single sign-on and single sign-out across all your apps over OpenID Connect, OAuth 2.0, and SAML 2.0
• Social login and identity brokering with external OIDC or SAML providers
• User federation against LDAP or Active Directory, plus custom user stores
• Multi-factor authentication, including OTP and WebAuthn/passkeys
• Fine-grained, policy-based authorization beyond simple roles
• A self-service account console for users and an admin console for operators
• Customizable login themes and an extensible SPI for custom logic

Where does Keycloak fall short?

• No first-party managed cloud. Unlike Auth0 or Okta, the Keycloak project ships only the self-hosted server — there’s no official hosted SaaS, so managed hosting means a third-party vendor or running it yourself.
• Quarkus migration broke older setups. The move from WildFly to Quarkus removed XML configuration (with no auto-migration) and dropped the /auth context path from default URLs, so upgrades from older versions can break existing client integrations.
• Multi-region high availability is hard. Its synchronous cross-site replication assumes low-latency networking, and recovering from a cross-site failure needs manual re-synchronization — so geographically distributed active-active is not turnkey.
• JVM footprint. It runs on the JVM, so it carries a heavier baseline memory appetite than lightweight Go or Node identity servers.

Is Keycloak free?

Yes — Keycloak is fully free and open source under the Apache-2.0 license, with no paid edition, feature gating, or per-user fees from the project itself. You pay only for the infrastructure you run it on and the engineering time to operate it. Red Hat build of Keycloak is a separately supported commercial distribution, but the upstream project is free.

What does Keycloak replace?

Keycloak is a self-hosted alternative to hosted identity platforms like Auth0, Okta, Microsoft Entra ID (formerly Azure AD), and Amazon Cognito. It delivers the same SSO, MFA, and user-management job, but you run it on your own infrastructure and avoid per-active-user cloud pricing.

FAQ

Is Keycloak open source? Yes, fully. Keycloak is licensed under Apache-2.0 — an OSI-approved license — and is a CNCF incubating project, so the entire feature set is free with no open-core restrictions.

Can I self-host Keycloak for free? Yes. Self-hosting is free; you pay only for the server, database, and operations. The Keycloak project offers no managed cloud, so self-hosting (or a third-party host) is the way to run it.

Is Keycloak a good Auth0 or Okta alternative? For teams that want to own their identity stack, yes — it matches the core SSO, MFA, and federation features without per-user pricing. If you’d rather not operate a Java service and want a managed SLA, a hosted platform may be the easier path.

What do I need to run Keycloak? A Java runtime (it ships as a container built on Quarkus) and a supported relational database such as PostgreSQL for production. For lighter self-hosted setups, tools like Authentik or Authelia may be simpler to operate.