Keycloak

Keycloak is an open-source identity and access management platform. It secures web applications, REST services, and other workloads through centralized authentication and authorization.

The project supports single sign-on, single sign-out, user management, identity federation, social login, user federation, and customizable login, account, and administration interfaces. It is distributed under the Apache License 2.0.

Keycloak can run on virtual machines, bare-metal servers, containers, Kubernetes, and OpenShift. Its current distribution uses Quarkus and includes official container images and a Kubernetes operator.

Keycloak supports OpenID Connect, OAuth 2.0, and SAML-based application security. It can act as an identity provider or connect applications to external identity providers.

Core capabilities include browser-based SSO, user registration, password policies, multi-factor authentication, WebAuthn, passkeys, account management, role-based access control, groups, client scopes, and token management.

Authorization Services provide centralized, fine-grained permission policies. Administrators can manage realms, users, clients, roles, groups, identity providers, and sessions through the administration console or REST API.

Integration options include LDAP and Active Directory user federation, external providers such as Google and Facebook, custom user-storage providers, supported relational databases, Docker, Podman, Kubernetes, and OpenShift.

Keycloak supports extension through themes, providers, service-provider interfaces, client libraries, and community-maintained extensions. The project provides JavaScript client libraries, Java administration and authorization clients, and a policy enforcer.

The community edition is available at no software cost under the Apache License 2.0. Users operate the infrastructure, database, upgrades, monitoring, security configuration, and support arrangements themselves.

Keycloak does not publish a hosted SaaS pricing table or a conventional time-limited trial. The software can be downloaded and deployed for evaluation without purchasing a license.

Red Hat offers a commercial Red Hat build of Keycloak based on the upstream project. Entitlement is included with certain Red Hat subscriptions, including Red Hat Runtimes, Red Hat Application Foundations, and OpenShift Container Platform. Public list pricing was not verified.

Keycloak offers extensive standards support, self-hosted control, broad federation options, customizable interfaces, and no community-edition license fee.

Its main trade-offs are operational complexity, infrastructure responsibility, upgrade planning, and the need for specialist IAM knowledge in larger deployments. Commercial support and certified distributions require separate vendor arrangements.

Comparable products include Authentik, Gluu Server, WSO2 Identity Server, ForgeRock, Okta Customer Identity, Microsoft Entra External ID, Auth0, and Ping Identity. The closest choice depends on deployment preferences, protocol requirements, support expectations, and whether a managed service is required.

Is Keycloak free?
Yes. The community distribution is open source and licensed under Apache License 2.0. Infrastructure and operational costs remain the user’s responsibility.

Does Keycloak provide a hosted cloud service?
The upstream project provides software, container images, and deployment tooling rather than a first-party hosted SaaS plan.

What platforms does Keycloak support?
It runs on Linux and Windows servers, containers, Kubernetes, and OpenShift. The web consoles work in current Chrome, Firefox, Edge, and Safari browsers.

Does Keycloak have an API?
Yes. It provides an Administration REST API, Java APIs, client libraries, and extension interfaces.

Can Keycloak connect to Active Directory?
Yes. Keycloak supports LDAP and Active Directory integration through user federation.

Does Keycloak offer a free trial?
There is no separate trial plan because the community software can be downloaded and deployed without a license fee.