Side by side
Keycloak vs Shibboleth
Both stand on single sign-on software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Keycloak provides single sign-on, multiple authentication methods, directory synchronization, and fine-grained authorization policies as open-source software. Some features need enabling, and the project recommends Red Hat build of Keycloak for users who need long-term support for specific versions.
Visit KeycloakShibboleth offers identity-provider, service-provider, discovery, and metadata capabilities, with a broad range of listed protocols and directory integrations. Organisations should note that lifecycle provisioning is absent and review the project’s stated security update recommendation.
Visit ShibbolethThe facts
| Keycloak | Shibboleth | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | API, Linux, Self-hosted, Web, Windows | Linux, Mac, Self-hosted, Windows |
| Lowest paid plan | Free or on request | Academic/Non-Profit Small: $3,354 a year |
| Plans published | 1 | 10 |
| Maker | Not published | Not published |
| Website | keycloak.org | shibboleth.net |
| On single sign-on software | #11 of 34 | #15 of 34 |
Keycloak: what it does well
- Supports OpenID Connect, OAuth 2.0, and SAML
- Offers passkeys, passwords, certificates, and two-factor methods
- Synchronizes users from LDAP and Active Directory
- Provides server, container, and operator deployments
What to know first
- Some features are disabled by default
- Preview features may not be generally available as supported features
- Long-term support for specific versions points to Red Hat build
Shibboleth: what it does well
- Supports four listed SSO protocols.
- Integrates with LDAP and Kerberos.
- Includes built-in MFA and adaptive access.
- Metadata Aggregator verifies signed metadata.
- Free, open-source software.
What to know first
- Lifecycle provisioning is not included.
- Consortium-only support includes developer Q&A and Slack.
- Project recommends version 5.2.2 or later for a listed vulnerability.
Alternatives to Keycloak Alternatives to Shibboleth The whole list