Keycloak

Keycloak is the most widely adopted open-source IAM system: single sign-on, identity brokering, social login, user federation from LDAP and Active Directory, MFA, and fine-grained authorization policies, all speaking OpenID Connect, OAuth 2.0, and SAML 2.0. The admin console, account management, and themable login pages give teams a complete security layer without building login, registration, token management, or permissions from scratch.

Originally a Red Hat community project released in 2014, Keycloak was donated to the CNCF in April 2023 and joined as an incubating project, with Red Hat continuing to ship a commercial build from the upstream. The modern Quarkus-based runtime replaced the old WildFly base, and stable release 26.5.6 shipped in March 2026. It is Apache 2.0 licensed with no per-user fee, which makes the cost model flat as headcount grows.

The trade-offs are operational: you run and harden the server yourself, upgrades across major versions need care, and the admin UI shows its age next to newer developer-first auth products. For teams that want open-source freedom, multi-cloud flexibility, and full protocol control, it remains the default answer.

Run the official container or download a distribution, connect a database, open the admin console.