Keycloak
Keycloak is an open source identity and access management (IAM) server that adds authentication and authorization to applications and services without forcing you to build your own user store, login screens or token machinery. Created at Red Hat and now developed as a community project, it provides single sign-on for browser applications and REST APIs using the standard protocols OpenID Connect, OAuth 2.0 and SAML 2.0. The current release line is 26.8.1, published in October 2026.
Key Features
- Single sign-on (SSO) — users authenticate once against Keycloak and are signed in automatically to every application that trusts it, with centralised logout across those clients.
- Standard protocols — OpenID Connect and OAuth 2.0 for web, mobile and service clients, plus SAML 2.0 for existing enterprise applications. Keycloak ships a certified OpenID Provider implementation.
- Identity brokering and social login — delegate authentication to external OpenID Connect or SAML 2.0 identity providers, including Google, GitHub, GitLab, Microsoft, Facebook, LinkedIn and StackOverflow, or to another Keycloak instance.
- User federation — connect to an existing LDAP or Active Directory directory, or plug in a custom user storage provider, so people keep using the accounts they already have.
- Realms (multi-tenancy) — isolate users, clients, roles and settings in separate realms, with the master realm administering the rest; Organizations provide per-tenant groupings inside a realm.
- Admin console, REST API and CLI — a modern web console for day-to-day management, a full Admin REST API for automation, and the
kcadm.shcommand-line client, alongside an Account console where users manage their own profile, credentials and active sessions. - Strong authentication — configurable authentication flows with one-time passwords (TOTP/HOTP), WebAuthn and passkeys, recovery codes, step-up authentication and conditional flows.
- Fine-grained authorization — role-based access control with realm, client and composite roles, plus an authorization services layer for resource- and policy-based decisions.
- Extensible and themeable — login, account, admin and email themes can be replaced, and the server exposes Service Provider Interfaces (SPIs) for custom authenticators, user storage providers and protocol mappers.
- Built to deploy — a Quarkus-based distribution running on the JVM, with a development mode for a quick start and a production mode that runs against PostgreSQL, MariaDB, MySQL or Oracle and scales horizontally across a cluster.
Why Use Keycloak?
Authentication is one of the hardest parts of an application to get right and one of the least rewarding to build in-house. Keycloak provides a mature, standards-compliant implementation of SSO, token issuance and identity federation — functionality that commercial IAM platforms charge for — under the Apache-2.0 licence, with no per-user fees or seat limits. Because it speaks OIDC, OAuth 2.0 and SAML 2.0, it can sit in front of existing applications without rewriting them, and because the whole stack is self-hosted, user data stays on infrastructure you control. The trade-off is operational: you run the server, the database and the backups, so it suits teams that want ownership of their identity layer rather than a managed service.
Use Cases
- Adding SSO to a portfolio of internal or customer-facing web applications.
- Replacing a commercial identity provider (Okta, Auth0, Entra ID) with a self-hosted alternative.
- Securing REST APIs and microservices with OAuth 2.0 access tokens.
- Federating an existing LDAP or Active Directory user base into modern applications.
- Giving each customer of a multi-tenant SaaS platform an isolated realm and branded login experience.
- Running an identity provider for a homelab or self-hosted service stack such as Nextcloud, Grafana or Wiki.js.
Platforms
Linux, macOS and Windows (Java-based server distribution) · Docker/Podman container images · Kubernetes and OpenShift (Operator and Helm charts)
Licence
Apache-2.0 (open source)