Keycloak

Keycloak is an open source identity and access management platform for adding authentication and authorization to applications without building it from scratch. It's commonly deployed as a self-hosted alternative to Okta or Auth0 by teams that want single sign-on, protocol-standard identity, and user federation running on their own infrastructure. Keycloak is a CNCF project backed by Red Hat and a broad contributor base, with strong marks on the OpenSSF Scorecard and Best Practices badge.

Key features

• Single sign-on: users authenticate once against Keycloak and gain access to every connected application without logging in again.
• Standard protocol support: OpenID Connect and SAML 2.0 are supported natively, so Keycloak plugs into existing identity-aware infrastructure without custom glue code.
• User federation: connect existing LDAP or Active Directory user stores instead of migrating users into Keycloak's own database.
• Fine-grained authorization: define resource-based permissions and policies that go beyond simple role checks.
• Social and identity brokering: let users log in through external identity providers alongside Keycloak's own user store, brokering the session either way.
• Admin console and REST API: manage tenants, clients, and users through a web console, or automate the same operations entirely through the API.
• Translated interface: the admin console and login pages are translated through a community-driven Weblate project, with translation status tracked publicly.

Ideal use cases

Organizations consolidating a sprawl of application-specific logins use Keycloak to centralize SSO across internal tools, customer-facing products, and legacy systems that only speak SAML. Because user federation talks directly to existing LDAP or Active Directory servers, Keycloak can sit in front of an existing identity source without a disruptive user migration project.

Self-hosting and deployment

Keycloak ships as a downloadable distribution, started with bin/kc.sh start-dev (or kc.bat start-dev on Windows) for development, and as a Docker image at quay.io/keycloak/keycloak, started with docker run quay.io/keycloak/keycloak start-dev. It also has a Community Operator for Kubernetes deployments, listed on Artifact Hub, and separate Java adapters and a Node.js Connect library exist for integrating existing applications with Keycloak's authentication flows.

Contributing and community

Keycloak's contribution process is documented in a public guide, and the project holds regular community meetings that anyone can join to help shape the roadmap. Support channels include a user mailing list plus #keycloak and #keycloak-dev Slack channels hosted on the CNCF Slack workspace, and the project follows the CNCF Code of Conduct across all of its spaces.

Reporting issues and security

Bugs are reported through GitHub issues with reproduction steps, while security vulnerabilities go through a documented private disclosure process instead of public issues. The project tracks its OpenSSF Scorecard and Best Practices badge as public indicators of project health, alongside its CLOMonitor score.

Tech stack

Keycloak is written in Java, licensed under Apache 2.0, and governed as part of the Cloud Native Computing Foundation, alongside related projects like Keycloak Client and Keycloak QuickStarts.