{
  "slug": "keycloak",
  "name": "Keycloak",
  "aliases": ["Red Hat build of Keycloak", "RH-SSO"],
  "vendor": { "name": "Keycloak project (CNCF incubating, originated at Red Hat)", "slug": "keycloak-project", "website": "https://www.keycloak.org" },
  "homepage_url": "https://www.keycloak.org/",
  "docs_url": "https://www.keycloak.org/documentation",
  "repo_url": "https://github.com/keycloak/keycloak",
  "license_url": "https://github.com/keycloak/keycloak/blob/main/LICENSE.txt",
  "product_type": "application",
  "product_status": "active",
  "summary": "Open-source identity and access management server providing single sign-on with OpenID Connect, OAuth 2.0 and SAML, user federation and fine-grained authorization",
  "description": "Keycloak is an identity and access management server, licensed under Apache-2.0 and an incubating project of the Cloud Native Computing Foundation after originating at Red Hat. It acts as an OpenID Connect, OAuth 2.0 and SAML 2.0 identity provider for applications, offering login pages, single sign-on and sign-out, social and enterprise identity brokering, user federation with LDAP and Active Directory, multi-factor authentication including WebAuthn passkeys, and an authorization-services component for policy-based permissions. Realms isolate tenants, and an admin console and REST API manage clients, users, roles and themes.\n\nIt runs on Quarkus as a Java application, typically in a container with PostgreSQL or another relational database, and is a standard choice when an organization wants to own its identity provider rather than rent one. Red Hat sells a supported build for enterprise customers.\n\nKeycloak is comparatively heavy: memory use, clustering configuration and frequent major releases demand attention, and customizing flows or themes involves Java development.",
  "capabilities": ["OpenID Connect, OAuth 2.0 and SAML 2.0 identity provider", "Single sign-on across applications with session management", "User federation with LDAP and Active Directory and identity brokering with social or enterprise IdPs", "Multi-factor authentication including WebAuthn passkeys and OTP", "Authorization services for policy-based permissions", "Admin console, REST API and customizable themes and flows"],
  "workflows": ["Protect internal web applications with SSO and a reverse-proxy OIDC adapter", "Federate an existing LDAP directory into modern OIDC logins", "Issue tokens to APIs and mobile apps"],
  "advantages": ["Full-featured, standards-based and Apache-2.0", "Active community with CNCF governance", "Supported commercial build available from Red Hat"],
  "limitations": ["Resource-heavy Java application with involved clustering", "Frequent major releases require upgrade planning", "Customization often requires Java extensions"],
  "prerequisites": ["Java runtime or container", "Relational database such as PostgreSQL"],
  "audiences": ["Platform and security engineers", "Organizations self-hosting identity"],
  "alternatives": ["authentik", "supabase"],
  "comparison_notes": "authentik covers a similar protocol set with a Python and Go stack, a built-in application proxy and a lighter footprint, but reserves some features for its enterprise edition. Supabase Auth is an application-embedded authentication service rather than an organization-wide identity provider.",
  "categories": [{ "slug": "identity-access", "primary": true }],
  "tags": ["identity", "sso", "oidc", "saml", "open-source", "self-hosted", "cncf", "passkeys"],
  "use_cases": ["manage-identity", "secure-applications"],
  "operating_systems": ["linux", "macos", "windows"],
  "execution_modes": ["self-hosted"],
  "interfaces": ["web", "api"],
  "deployment_models": ["on-premises"],
  "integrations": ["LDAP", "Active Directory", "PostgreSQL", "Kubernetes", "Docker", "Google", "GitHub", "Microsoft Entra ID"],
  "data_formats": ["JSON", "JWT", "SAML XML"],
  "languages": ["Java", "TypeScript"],
  "source_model": "open-source",
  "license_spdx": "Apache-2.0",
  "pricing_model": ["open-source", "free"],
  "self_hostable": true,
  "sources": [
    { "url": "https://www.keycloak.org/", "type": "official_site", "title": "Keycloak", "supports": ["name", "summary", "vendor", "capabilities"], "checked_at": "2026-11-02", "note": "Footer states Keycloak is a Cloud Native Computing Foundation incubation project." },
    { "url": "https://www.keycloak.org/documentation", "type": "official_docs", "title": "Keycloak Documentation", "supports": ["capabilities", "prerequisites"], "checked_at": "2026-11-02" },
    { "url": "https://github.com/keycloak/keycloak/blob/main/LICENSE.txt", "type": "license_page", "title": "Keycloak LICENSE (Apache-2.0)", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02" }
  ],
  "confidence": "high",
  "discovery_method": "editorial-research",
  "depth": "standard",
  "editorial_status": "reviewed",
  "visibility": "public",
  "featured": false,
  "author": "batch-B2"
}