Keycloak

License	FOSS problems	Maintenance	SSO	Users	Tested
Apache-2.0Permissive license. Like MIT, but each contributor grants users a patent licence covering their contribution, preventing later suits.	—	Active	✅	Unlimited	❌

Description

Keycloak is a mature, enterprise-grade identity and access management platform — CNCF Incubating (accepted April 2023), originally created and still heavily backed by Red Hat. The most established option in this catalog by a wide margin, with roughly a decade of production use behind it.

Features

• OIDC, OAuth2, and SAML — SAML support is deeper and more battle-tested here than in any other option evaluated, which matters if a legacy or enterprise app needs SAML specifically rather than OIDC.
• LDAP/AD federation — connects to an existing directory rather than requiring Keycloak to be the sole source of identity, relevant mainly for organizations already running LDAP.
• Fine-grained authorization services — policy-based access control beyond simple SSO, closer to a full IAM platform than the other options here.

Usage patterns

Same central-SSO role as the other identity providers in this catalog. Where it stands apart: environments that need SAML federation or LDAP integration specifically — the other options here (Rauthy, Pocket ID, Authentik, Logto) are OIDC-first and treat SAML, where present at all, as a secondary feature.

License and governance

Apache-2.0, no open-core gating — CNCF governance structure applies (Code of Conduct, incubating-level project oversight), distinct from a single vendor unilaterally controlling the roadmap. Red Hat's continued heavy involvement is worth naming as a real dependency even without a formal open-core split: the project's direction is still substantially shaped by one company's priorities.

Conclusion

Why you would — the most mature, thoroughly-tested option here, and the only one with genuinely deep SAML/LDAP support. A safe default if either of those is a hard requirement.

Why you wouldn't — built on Java/Quarkus, a noticeably heavier resource footprint than Rauthy, Pocket ID, or even Authentik for a setup this size. Its admin console and configuration surface also reflect its enterprise-IAM scope — more to learn than a tool built specifically for the self-hosted-homelab case. For this project's actual needs (OIDC-based SSO across self-hosted apps, no SAML/LDAP requirement), it's more platform than necessary.

Sources: Keycloak GitHub, CNCF Keycloak project page