Keycloak
Top pickApache-2.0 identity, backed by Red Hat, running at enterprise scale.
93
sovereigntyKeycloak is the serious open answer to Okta: OpenID Connect, SAML, OAuth2, user federation to LDAP and Active Directory, fine-grained authorisation, MFA and an admin console that covers all of it. It is Apache-2.0, sponsored by Red Hat, a CNCF incubating project, and it already runs identity for organisations far larger than yours. Around 36k stars. Nothing about it is a compromise on capability — the cost is entirely in operating it, and identity is the service where operating it badly hurts most.
OPEN SOURCEApache-2.0SELF-HOSTLOCAL-FIRST
LicenseApache-2.0
PricingFree and open source. Red Hat build with commercial support available.
Open sourceYes
Self-hostableYes
Local-first dataYes
What it does well
- +Apache-2.0 with Red Hat behind it and CNCF governance
- +Genuinely enterprise-grade — SAML, OIDC, LDAP federation, fine-grained authz
- +No per-user cost, so growth does not raise the bill
- +Commercial support available if you need someone accountable
Where it falls short
- −Operating it well is a real skill — clustering, upgrades, database tuning
- −Admin console is powerful and not friendly
- −No pre-built integration catalogue on Okta's scale
- −Major version upgrades have broken things historically
Keycloak as an alternative to
Where Keycloak shows up in our comparisons, and how it ranked.
Keycloak head-to-head
Straight comparisons against the tools people weigh it against.