Keycloak
Keycloak: A capable open-source IAM server for teams that want self-hosted SSO and federation. Ranked #4 of 44 in Identity and Access Management Software by our editors (9.0/10); pricing: Open source; best for self-hosted open-source SSO and federation.
At a glance
- Editor score9.0 / 10
- PricingOpen source
- Best forSelf-hosted open-source SSO and federation
- Paid fromFree
- MFA methodsTOTP, HOTP, WebAuthn/passkeys, recovery codes
- Facts checked19 Sep 2026
Where it wins
- Supports OpenID Connect, OAuth 2.0, and SAML 2.0
- Combines LDAP, Active Directory, MFA, passkeys, and social login
- Provides fine-grained authorization and SCIM user and group management APIs
Where it doesn't
- Deployment and ongoing administration are managed by the organization
- SCIM support is a preview feature and disabled by default
- Requires self-hosted infrastructure such as virtual machines or containers
Our verdict on Keycloak
Keycloak is an open-source identity and access management server for web applications, REST services, and other applications. It is designed for organizations that want to manage authentication and access controls themselves across web, Windows, Linux, API, and self-hosted environments. Its core capabilities include single sign-on and single sign-out, identity brokering, social login, user and account management, role-based access, and fine-grained authorization policies.
Protocol and directory coverage are central strengths. Keycloak supports OpenID Connect, OAuth 2.0, and SAML 2.0, while LDAP and Active Directory federation connect it to existing user directories. Authentication options include TOTP and HOTP one-time passwords, WebAuthn and passkeys, and recovery codes. Integrations with Docker, Podman, Kubernetes, and OpenShift support several deployment models, while Google, GitHub, Facebook, and Twitter are listed for social-login integration. Administrative and account-management consoles provide web-based control over the server and its identity functions.
The trade-off is operational ownership. Organizations deploy and manage Keycloak themselves through virtual machines, containers, Kubernetes, or OpenShift, so it suits teams prepared to run an identity service rather than buyers seeking a vendor-managed plan. SCIM user and group management is available as a documented API, but it is a preview feature and disabled by default. Choose Keycloak when open-source control, federation, MFA, passkeys, and infrastructure flexibility matter. Consider another option if your priority is a fully managed IAM service or a mature, enabled-by-default SCIM experience.
Your product? Our editors can test Keycloak in depth and publish a review, labelled as paid · from $149/mo →
Keycloak pricing
Keycloak fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Free |
| SSO protocols | OpenID Connect, OAuth 2.0, SAML 2.0 |
| MFA methods | TOTP, HOTP, WebAuthn/passkeys, recovery codes |
| Directory sync | Yes |
| Lifecycle provisioning | Yes |
| Adaptive access policies | Not verified |
| Included users | Not verified |
| Deployment | Cloud, Desktop, Self-hosted |
| Platforms | Web, Windows, Linux |
| Integrations | 10 integrations: LDAP, Active Directory, Docker, Podman, Kubernetes, OpenShift … |
| Pricing | Open source |
| Website | keycloak.org |
| Facts checked | 19 Sep 2026 |
Keycloak integrations
Keycloak lists 10 integrations on its own site.
- LDAP
- Active Directory
- Docker
- Podman
- Kubernetes
- OpenShift
- GitHub
Alternatives to Keycloak
- Okta Workforce IdentityA broad workforce IAM suite for organizations with mature identity requirements.9.4
- Google Cloud IdentityA capable IAM choice for Google-centric teams that need MFA, SSO, and lifecycle controls.9.2
- Oracle Cloud Infrastructure Identity and Access ManagementA low-cost IAM option for OCI access, external users, and connected applications.9.1
See all Keycloak alternatives →
Keycloak vs the competition
- Keycloak vs Okta Workforce Identity
- Keycloak vs Google Cloud Identity
- Keycloak vs Oracle Cloud Infrastructure Identity and Access Management
- Keycloak vs AWS IAM Identity Center
- Keycloak vs Amazon Cognito
- Keycloak vs Thales OneWelcome Identity Platform
Compare Keycloak with any tool side by side →
Also Ranked In
Keycloak is ranked in 7 of our directories.
Used Keycloak? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Keycloak for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Keycloak is listed in our Identity and Access Management Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/keycloak/"><img src="https://www.itechguides.com/best/badge/keycloak.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update