Keycloak

What it does

Keycloak sits between your users and your applications. Your apps don't deal with login forms, authenticating users, or storing users — Keycloak handles that, and once a user is logged in, they don't have to log in again to reach a different application.

Features

• Single sign-on and single-sign out — one login grants access to all connected applications; one logout ends all of them.
• Identity brokering and social login — enable login with social networks or existing OpenID Connect and SAML 2.0 identity providers from the admin console. No code or changes to your application are required.
• User federation — built-in support for connecting to existing LDAP or Active Directory servers. If your users live elsewhere, such as a relational database, you can implement your own provider.
• Admin console — administrators centrally manage the server: enable and disable features, configure identity brokering and user federation, create and manage applications and services, define fine-grained authorization policies, and manage users, permissions, and sessions.
• Account management console — users manage their own accounts: update their profile, change passwords, set up two-factor authentication, manage sessions, and view account history. If social login or brokering is enabled, they can link their account to additional providers and authenticate to the same account through different identity providers.
• Standard protocols — based on OpenID Connect, OAuth 2.0, and SAML.
• Authorization services — when role-based authorization isn't enough, fine-grained authorization services let you manage permissions for all your services from the admin console and define exactly the policies you need.

FAQ

Is Keycloak free? Keycloak is open source. The homepage doesn't publish pricing or license details, so check the project documentation for licensing terms.

Which authentication protocols does it support? OpenID Connect, OAuth 2.0, and SAML.

Can it connect to my existing user database? Yes. There's built-in support for LDAP and Active Directory, and you can implement your own provider for other user stores, such as a relational database.

Do I need to change my application code to add social login? No. Social networks and existing OpenID Connect or SAML 2.0 identity providers are configured through the admin console.

Is there a hosted version? The homepage doesn't mention a hosted offering — Keycloak is presented as open-source software you run yourself.

How does two-factor authentication work? Users set it up themselves through the account management console. The homepage doesn't detail which two-factor methods are supported.

Alternatives

Keycloak is self-run software. If you'd rather use a hosted service, these cover similar ground:

• Auth0 — Identity platform for authentication and authorization.
• WorkOS — Enterprise auth: SSO, SCIM, and audit logs.
• Clerk — Drop-in auth and user management for modern apps.
• Better Auth — The open-source TypeScript auth framework.