Freedom251 › Self-Service Password Reset Software
Keycloak
What Keycloak is
Keycloak is open-source identity and access management software that adds authentication to applications and secure services. Its single sign-on lets users sign in once to reach multiple applications and sign out of them together. It supports OpenID Connect, OAuth 2.0, and SAML, and can authenticate users through external identity providers and social networks such as Google, GitHub, Facebook, and Twitter.
Authentication options include passwords, passkeys, X.509 certificates, and two-factor authentication with TOTP or HOTP and recovery codes. Keycloak can synchronize users from LDAP and Active Directory, bridge authentication through Kerberos, and let administrators define fine-grained authorization policies. Deployment options include a server distribution, a container image for Docker, Podman, Kubernetes, and OpenShift, and an operator for Kubernetes and OpenShift. The project uses the Apache License, Version 2.0. Some features are disabled by default; preview features require enabling and may not be generally available as supported features.
Who it suits
Keycloak suits teams that want to add authentication and access policies to applications or services. Its supported protocols, external identity providers, and directory synchronization can serve environments with varied identity sources.
What it does well
- Supports OpenID Connect, OAuth 2.0, and SAML
- Offers passkeys, passwords, certificates, and two-factor methods
- Synchronizes users from LDAP and Active Directory
- Provides server, container, and operator deployments
What to know first
- Some features are disabled by default
- Preview features may not be generally available as supported features
- Long-term support for specific versions points to Red Hat build
Limits
Keycloak is free, and no published paid plans or usage limits are stated. Some features are disabled by default, and preview features require enabling and may not be generally available as supported features.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Keycloak | Open-source identity and access management software · no published paid plans or usage limits found | Free |
As keycloak.org lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the Keycloak website.
- Choose the server distribution, container image, or operator for your environment.
- Deploy the selected option using its supported server, container, Kubernetes, or OpenShift route.
- Configure an authentication protocol and the sign-in methods your applications need.
- Connect external identity providers or synchronize users from LDAP or Active Directory if needed.
Verdict
Keycloak provides single sign-on, multiple authentication methods, directory synchronization, and fine-grained authorization policies as open-source software. Some features need enabling, and the project recommends Red Hat build of Keycloak for users who need long-term support for specific versions.
Questions
How much does Keycloak cost?
Keycloak is free and open source. No paid plans or usage limits are stated.
Which authentication protocols does Keycloak support?
It supports OpenID Connect, OAuth 2.0, and SAML.
What multi-factor methods are available?
Methods include TOTP, HOTP, WebAuthn or passkeys, and recovery codes. The project also lists passwords and X.509 certificates as authentication options.
Can Keycloak use external identity providers and directories?
Yes. It can authenticate through external OpenID Connect or SAML providers and listed social networks. It can synchronize users from LDAP and Active Directory and bridge authentication through Kerberos.
How can Keycloak be deployed?
The downloads page provides a server distribution, a container image for Docker, Podman, Kubernetes, and OpenShift, and an operator for Kubernetes and OpenShift.
What license does Keycloak use?
The project is licensed under the Apache License, Version 2.0.
Facts from Keycloak's own pages
- Authentication
- Keycloak supports passkeys, passwords, X.509 certificates, and two-factor authentication with recovery codes and TOTP/HOTP. · keycloak.org, 9 Oct 2026
- Authorization
- Administrators can define fine-grained authorization policies for applications and services. · keycloak.org, 9 Oct 2026
- Deployment
- The downloads page provides a server distribution, a container image for Docker, Podman, Kubernetes, and OpenShift, and an operator for Kubernetes and OpenShift. · keycloak.org, 9 Oct 2026
- Feature status
- Some features are disabled by default, and the project notes that preview features require enabling and may not be generally available as supported features. · keycloak.org, 9 Oct 2026
- Identity brokering
- Keycloak can authenticate users through external OpenID Connect or SAML identity providers and social networks including Google, GitHub, Facebook, and Twitter. · keycloak.org, 9 Oct 2026
- Licensing
- The Keycloak project is licensed under the Apache License, Version 2.0. · github.com, 9 Oct 2026
- Project home
- Keycloak is an open-source identity and access management project accepted into the CNCF as an incubating project in April 2023. · cncf.io, 9 Oct 2026
- Protocols
- Keycloak supports OpenID Connect, OAuth 2.0, and SAML. · keycloak.org, 9 Oct 2026
- Purpose
- Keycloak adds authentication to applications and secure services, so they do not need to store or authenticate users themselves. · keycloak.org, 9 Oct 2026
- Security reporting
- The project asks vulnerability reporters to email its security team and says it aims to acknowledge reports within seven business days. · keycloak.org, 9 Oct 2026
- Single sign-on
- Users can sign in once through Keycloak to access multiple applications and sign out of them together. · keycloak.org, 9 Oct 2026
- Support
- The project recommends Red Hat build of Keycloak for users who cannot regularly upgrade and need long-term support for specific versions. · keycloak.org, 9 Oct 2026
- User federation
- Keycloak can synchronize users from LDAP and Active Directory servers and bridge authentication through Kerberos. · keycloak.org, 9 Oct 2026
Where Keycloak stands on Freedom251
- Self-Service Password Reset Software#3 of 23
- Passkey Authentication Software#14 of 55
- Identity and Access Management Software#14 of 45
- Single Sign-On Software#11 of 34
- Authentication Software#11 of 31
- Customer Identity and Access Management Software#11 of 29
- OAuth Server Software#18 of 32