Keycloak
Open-source identity and access management — SSO, OAuth2/OIDC, and user federation.
Self-hosted Open source Apache 2.0 ssoidentityoauth
Pricing
Free (open source, backed by Red Hat).
Keycloak is the tool most self-hosted stacks reach for once they need real single sign-on across multiple internal apps — it speaks OAuth2, OIDC, and SAML, and can federate against existing LDAP/AD.
Key features
- OAuth2, OIDC, and SAML support out of the box
- User federation against LDAP/Active Directory
- Fine-grained role and permission management
- Admin console for managing realms and clients without code
Self-hosted vs. cloud
Self-hosted, typically behind your own reverse proxy with a Postgres backend. No official managed cloud, though several third parties offer hosted Keycloak.
Quick start
docker run -d -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak start-dev
Alternatives
For simpler password-vault-only needs without full SSO, Vaultwarden is a much lighter footprint.