Keycloak

Keycloak is an open-source identity and access management (IAM) platform maintained as a CNCF Incubating project and sponsored primarily by Red Hat. It provides centralised authentication and authorisation for applications and services, acting as an identity provider (IdP) that applications delegate sign-in to rather than handling credentials themselves.

Keycloak is a standards-based platform: it implements OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0, which means any application or service that speaks these protocols can integrate regardless of language or framework. Python, Java, PHP, Go, Ruby, Node.js, and .NET applications all connect through the same OIDC/SAML layer — making Keycloak one of the few auth solutions that genuinely works across every major backend ecosystem.

The platform is organised around realms — isolated namespaces for users, clients, and configuration — making it practical for multi-tenant deployments where different applications or organisations need separate identity spaces with their own branding, policies, and user bases.

User federation connects Keycloak to existing user directories: LDAP and Active Directory sync is built in, and a custom User Storage SPI (Service Provider Interface) allows connecting to any existing user database without migrating data. Identity brokering enables Keycloak to act as an intermediary between your application and external providers (Azure AD, Okta, Google, GitHub), handling protocol translation in both directions.

Keycloak runs as a self-hosted Java service built on Quarkus. Deployment is via Docker, Kubernetes (official Helm charts provided), or a bare-metal JVM. Red Hat ships a commercially supported variant, Red Hat Single Sign-On (RH-SSO), for enterprise customers who need SLA-backed support. The community edition is free with no user limits, no per-MAU pricing, and no feature gating.