Skip to content
OpenSourceSoftware.ai
Keycloak logo

Keycloak

keycloak · Identity & access

GitHub stars

37,594
—Awaiting first sync

Awaiting first sync

No measured star history yet

What is Keycloak?

Keycloak takes sign-in out of each application and puts it in one server you run. Apps send people to Keycloak to log in, and Keycloak hands back a verified identity. Your team gets one place to manage users, sessions and access rules, while people get one login and one page to manage their own account.

Keycloak is an open-source identity and access management server. Applications hand sign-in to it instead of storing passwords themselves, using OpenID Connect, OAuth 2.0 or SAML. It also connects to LDAP and Active Directory, and adds social login, two-factor sign-in and passkeys.

Core capabilities

  • Single sign-on and single sign-out across apps using OpenID Connect, OAuth 2.0 and SAML.
  • Connect to LDAP and Active Directory, or let people sign in with social and external identity providers.
  • Add passkeys, one-time passwords and recovery codes, with an admin console and a user account console.

Single sign-on and existing directories

Keycloak speaks OpenID Connect, OAuth 2.0 and SAML, so most modern and older applications can use it. Users sign in once and can sign out of every app together. Built-in federation reads users from LDAP and Active Directory, and identity brokering lets people sign in through social networks or external OpenID Connect and SAML identity providers set up in the admin console.

  • SSO
  • OpenID Connect
  • SAML
  • LDAP
  • Active Directory

Stronger sign-in and two consoles

The documentation covers passkeys, time-based and counter-based one-time passwords such as Google Authenticator or FreeOTP, and recovery codes. Administrators use the admin console to manage realms, clients, users, sessions and authorization policies. Users have their own account console to update their profile, change their password, set up two-factor sign-in, review sessions and link other sign-in accounts.

  • Passkeys
  • MFA
  • Admin console
  • Account console

Run it in a container or on Kubernetes

Keycloak is licensed under Apache 2.0 and is a CNCF incubation project. A single docker run command with the start-dev option gives a test server; production needs a supported database such as PostgreSQL or MySQL, HTTPS and a hostname. The Keycloak Operator installs on Kubernetes or OpenShift and manages the server, realm imports and clients through custom resources.

  • Apache-2.0
  • Docker
  • Kubernetes Operator
  • PostgreSQL

Where it fits

Use cases

  1. 01

    Put all internal apps behind one login

    Create a realm, then register each application as an OpenID Connect or SAML client in the admin console with its redirect address. Staff sign in once and reach every app, and signing out ends their sessions everywhere.

  2. 02

    Reuse your existing company directory

    Add an LDAP or Active Directory provider to the realm, choose how users are synchronised and map directory fields to Keycloak attributes. Employees keep signing in with the credentials they already have.

  3. 03

    Require stronger sign-in for staff and customers

    Enable passkeys or one-time passwords in the authentication flow, and turn on recovery codes as a backup. Add Google, GitHub or a partner's SAML identity provider so people can sign in with accounts they already own.