Alternatives to Keycloak

A self-hosted identity and access management server that adds single sign-on and login to applications. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as Keycloak.

  • Zitadel

    An open-source identity and access management platform with SSO, MFA and a hosted login page.

    FreemiumOpen sourceWebSelf-hosted

    Zitadel is an open source, self-hostable identity platform with built-in MFA, passwordless login, multi-tenancy and SDKs, with a freemium model and developer focus.

  • Casdoor

    A self-hosted identity and access management server with single sign-on, MFA and a web interface.

    FreeOpen sourceWebSelf-hosted

    Casdoor is also Apache-licensed and self-hosted, adding CAS, LDAP and SCIM support and WebAuthn or TOTP MFA, though its wide feature scope adds complexity.

  • Kanidm

    An open-source identity management server offering OAuth2, LDAP and passkey login from one place.

    FreeOpen sourceLinuxSelf-hostedCommand line

    Kanidm is an open-source identity server offering OAuth2, LDAP and passkeys together with Unix login integration, but with a smaller ecosystem than established servers.

  • Microsoft Entra ID

    Microsoft's cloud identity and access management service, formerly Azure Active Directory, with single sign-on support.

    PaidProprietaryWeb

    Microsoft Entra ID is a paid cloud-only service with single sign-on, removing server administration but tying identities to Microsoft's platform.

Also worth comparing

These listings name Keycloak as their own alternative, so the relationship runs both ways.

  • Authelia

    Self-hosted single sign-on and two-factor portal for reverse proxies.

    FreeOpen sourceLinuxWebSelf-hosted

    Keycloak is a self-hosted identity server with OpenID Connect, SAML 2.0 and LDAP or Active Directory support, and takes real administrative effort to set up and secure.

  • authentik

    Self-hosted identity provider for single sign-on and application access control.

    FreeOpen sourceLinuxSelf-hostedWeb

    Keycloak is an Apache-2.0 identity server offering OpenID Connect, SAML 2.0 brokering and LDAP or Active Directory connections, without a paid enterprise edition, but with real setup effort.

  • FusionAuth

    An identity and user management server with SSO, MFA and OAuth2 that can be self-hosted.

    FreemiumProprietaryWebSelf-hosted

    Keycloak is fully open source under Apache-2.0, offering SSO with OpenID Connect and SAML brokering plus LDAP and Active Directory connections.

  • JumpCloud

    A cloud directory platform for managing user identities, access and devices across several operating systems.

    PaidProprietaryWindowsmacOSLinuxAndroidWeb

    Keycloak is a free self-hosted SSO server with OIDC and SAML, covering identity and login but not device management.

  • Pocket ID

    Small OpenID Connect provider that signs users in with passkeys only.

    FreeOpen sourceWebSelf-hosted

    Keycloak adds OpenID Connect and SAML brokering plus LDAP and Active Directory connections, at the cost of real administrative setup effort.

  • privacyIDEA

    Open-source, self-hosted multi-factor authentication server that manages OTP and other token types.

    FreeOpen sourceLinuxSelf-hosted

    Keycloak is an open source identity server that includes MFA as part of single sign-on for applications, rather than a dedicated token management server for VPN and SSH.

Similar software

Related functionality, not a direct replacement.