About Keycloak
Keycloak is an open source identity and access management server. It lets your applications hand off sign-in, so they do not need to store users or build their own login forms.
What it does
Keycloak authenticates users on behalf of your applications. Once someone signs in, they stay signed in across the other apps that use the same server, and signing out of one app ends the session everywhere. It can also connect to existing LDAP or Active Directory servers, and to outside identity providers that use OpenID Connect or SAML 2.0.
Key features
- Single sign-on and single sign-out
- Social login and identity brokering
- LDAP and Active Directory user federation
- Admin console for users, clients and access policies
- Account console for profile, passwords and two-factor setup
Who it's for
Teams that run several internal or customer-facing applications and want one place to manage logins, roles and access. It suits developers and platform engineers who would rather configure a central identity server than write login code for every app.
Pricing and good to know
Keycloak is open source under the Apache 2.0 license and can be self-hosted with no software fee. Most setup happens in the admin console, but a production deployment still needs planning for servers, databases, backups and upgrades.
Highlights
- Single sign-on across several applications
- Social login and links to external identity providers
- Connect existing LDAP or Active Directory users
- Manage users, clients and access policies in one console
- Let users manage their own profile and two-factor setup
