Keycloak review covering single sign-on, OAuth/OIDC/SAML support, self-hosting, and how it compares to Auth0, Okta and other IAM tools.
Keycloak is an open-source identity and access management platform that provides single sign-on, social login, and user federation for applications and services. Co-founded in 2013 by Stian Thorgersen at Red Hat, with its first production release in September 2014, Keycloak was long stewarded by Red Hat as the upstream project for its commercial Red Hat Single Sign-On product before being donated to the Cloud Native Computing Foundation in April 2023 as an incubating project.
Rather than requiring each application to implement its own login system, Keycloak centralizes authentication: users sign in once through Keycloak and are issued tokens that grant access across every connected application, implementing genuine single sign-on and single sign-out across an organization's software estate.
Keycloak is built on open standards, providing full support for OpenID Connect, OAuth 2.0, and SAML 2.0, which means it interoperates with existing identity providers, client libraries, and enterprise systems. It supports identity brokering and social login out of the box, and includes native connectors to LDAP and Active Directory so organizations can federate against an existing user directory instead of migrating accounts.
Administration is split between a centralized admin console for managing realms, roles, clients and authorization policies, and a self-service account console where end users handle their own password changes and two-factor authentication setup. Fine-grained, resource-level authorization policies extend beyond simple role-based access control for organizations with complex permission requirements.
Keycloak itself is fully open-source and free to use under the Apache 2.0 license, with no per-user or per-monthly-active-user licensing fees, since it is designed to be self-hosted on an organization's own infrastructure or Kubernetes cluster. Costs are limited to hosting, operational overhead, and engineering time to deploy, patch, and scale the identity server.
Organizations that want commercial support and a hardened, enterprise-supported distribution can purchase Red Hat build of Keycloak, Red Hat's supported offering built on the upstream project; pricing for that support contract is not published and requires contacting Red Hat directly.
Yes, Keycloak is fully open-source under the Apache 2.0 license and free to self-host, with no per-user licensing fees.
Keycloak was co-founded in 2013 by Stian Thorgersen, a Red Hat developer, and has since been donated to the Cloud Native Computing Foundation as an incubating project.
Keycloak fully supports OpenID Connect, OAuth 2.0 and SAML 2.0, the major standards for authentication and authorization.
Yes, Keycloak includes built-in connectors to integrate with existing LDAP or Active Directory servers.
Red Hat originally stewarded Keycloak and continues to ship a commercially supported distribution, but the upstream project has been governed by the CNCF since April 2023.
Common alternatives include commercial SaaS providers like Auth0, Okta and Microsoft Entra ID, as well as other self-hostable open-source options like Ory, Authentik and Zitadel.