🩺 Vitals
- 🟢 Last active: 2026-10-11
- 📦 Latest release: 26.8.0 (2026-10-01)
- 🐞 Open issues: 3245
- 🌟 Stars: 37.3k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: keycloak.org
- Source: github.com/keycloak/keycloak
- License: Apache 2.0
- Deployment: Docker / Kubernetes
- Data Model: PostgreSQL / MySQL / MariaDB / Microsoft SQL Server / Oracle
- Jurisdiction: USA 🇺🇸 (The Linux Foundation)
- Compliance (SaaS): N/A (No managed service)
- Compliance (Self-Hosted): HIPAA Ready | GDPR Ready
- Complexity: Low (2/5) - Java app plus a single external database; the Infinispan cache is in-process, and a second instance for high availability is the documented production norm, not a separate tier
- Maintenance: Moderate (3/5) - JVM/app upgrades plus database migrations and backups
- User Management: Very High (5/5) - Self-hosted SAML/OIDC SSO, granular RBAC, admin and user event auditing, and SCIM provisioning
1. The Executive Summary
What is it? Keycloak is an Apache 2.0-licensed Identity and Access Management (IAM) platform and a Cloud Native Computing Foundation (CNCF) project, accepted at the incubating level in April 2023. It provides Single Sign-On (SSO), Identity Brokering, User Federation, and fine-grained authorization policies deployable on any infrastructure. For enterprises, it replaces per-user SaaS licensing with a self-hosted identity plane where user data never leaves the organization's own servers.
The Strategic Verdict:
- 🔴 For Minimal Operational Overhead: Caution. Keycloak requires dedicated internal expertise for deployment, maintenance, and scaling. It is not a "set-and-forget" SaaS solution.
- 🟢 For Enterprises Demanding Sovereignty: Strong Buy. For organizations with strict compliance requirements or large user bases, Keycloak removes per-user licensing entirely and keeps the identity plane, with its SSO, RBAC, audit and provisioning machinery, under the organization's own control.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Okta (SaaS) | Keycloak (Self-Hosted) |
|---|---|---|
| Pricing Model | Per-seat, contract minimum / fixed term, Adaptive MFA only in a higher tier; grows with headcount | No license fee (Apache-2.0) |
| Operations | Vendor-managed (hosting, upgrades and availability) | Multi-node cluster (HA), grows with login volume |
| Exit | Management REST API (JSON), partial export (passwords) | Realm export (JSON, kc.sh export) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Keycloak is typically deployed as a containerized Java application. On Kubernetes, the project's own Operator is the standard path for high availability.
- Scalability: Designed for horizontal scalability, supporting clustering for high availability and load balancing. Proper caching strategies (Infinispan) are crucial for performance, and CPU grows with the rate of logins and token requests (sizing guide).
- Data Exit: A realm export writes realms, clients and users to JSON, but only with the server stopped, and it leaves out user and admin events and sessions. The database itself is the complete copy.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Single-Vendor Stewardship (The Linux Foundation / USA): Keycloak is a CNCF project, and the CNCF is a project of The Linux Foundation, a US nonprofit that holds the trademark. The CLOUD Act is moot for a self-hosted install: neither the foundation nor the maintainers run any service that holds your identity data. The live risk is stewardship: most of the project's listed maintainers work for one vendor (IBM at the time of review), so the roadmap and release cadence follow that vendor's priorities, while foundation hosting and the Apache 2.0 license keep a fork open to anyone.
- The Compliance Shift: Keycloak assumes zero operational responsibility. The project provides no managed service, SLA, or compliance certification coverage. To satisfy SOC 2, ISO 27001, or HIPAA audits, the enterprise must independently manage infrastructure security, database encryption at rest and in transit, high-availability clustering, CVE patching, and complete audit log retention. User and admin event storage is off by default: switch it on per realm to keep an audit trail.
- License Risk: None. Apache 2.0 is commercially permissive, and the CNCF hosts only projects under OSI-approved licenses: no copyleft clauses, no SSPL or BUSL restrictions. Enterprises may fork, embed, or modify Keycloak with no obligation to publish their changes; redistribution only carries the license and its notices. Commercial support from third parties exists but is optional.
4. Market Landscape
🏢 Proprietary Incumbents
- Okta: The dominant SaaS IAM platform; enterprises switch to Keycloak to drop per-user licensing and reclaim control over identity data. Okta, Inc. is a US company that hosts customer data in cells in the US, EMEA, Japan, Australia, Canada and India; as a US provider it is reachable under the CLOUD Act wherever the data sits.
- Auth0: A developer-centric identity-as-a-service platform acquired by Okta; Keycloak provides equivalent features (SSO, social login, MFA) with no per-user license fee and full self-hosted control.