Keycloak
Keycloak is an open-source identity and access management solution that provides single sign-on, user federation, and support for standards like OAuth2 and OpenID Connect for securing applications and APIs.
Definition
Keycloak is an open-source identity and access management solution that provides single sign-on, user federation, and support for standards like OAuth2 and OpenID Connect for securing applications and APIs.
Overview
Building authentication and authorization from scratch, handling passwords, sessions, multi-factor authentication, and standards compliance, is a significant undertaking that most applications shouldn't reinvent. Keycloak centralizes this by acting as a dedicated identity provider: applications redirect users to Keycloak to log in, and Keycloak issues tokens the application can trust, rather than each service managing its own user database and login logic. It implements widely adopted identity standards, including OAuth2, OpenID Connect, and SAML, so it can integrate with a broad range of applications and other identity providers, including social logins and enterprise directories like LDAP or Active Directory. Keycloak also supports identity brokering and user federation, letting organizations connect multiple existing user stores through a single, unified login experience. Its admin console lets teams manage realms (isolated groups of users and applications), configure fine-grained roles and permissions, and enforce policies like multi-factor authentication, all without writing custom authentication code. Keycloak competes with services like Auth0, Ory, and Zitadel, differentiating itself as a self-hostable, fully open-source option for teams that want to control their own identity infrastructure rather than depend on a hosted vendor.
Key Features
- Single sign-on (SSO) across multiple applications
- Support for OAuth2, OpenID Connect, and SAML standards
- User federation with LDAP and Active Directory
- Identity brokering with external and social identity providers
- Fine-grained role-based access control per application
- Multi-factor authentication and configurable login policies
- Self-hostable, fully open-source deployment