Keycloak

Keycloak is a mature, battle-tested identity and access management server that handles SSO, user authentication, and authorization so your applications don’t have to. Built under the Cloud Native Computing Foundation and written in Java, it’s the open-source choice for teams that need serious auth infrastructure without paying enterprise license fees.

Rather than building login forms, session management, and token handling into every service you ship, you point your apps at a single Keycloak instance. It speaks OpenID Connect, OAuth 2.0, and SAML 2.0, so it integrates with virtually anything. User federation connects an existing LDAP or Active Directory directory, and social login covers Google, GitHub, Facebook, and more out of the box.

The admin console handles everything from user management and group policies to fine-grained authorization rules and custom authentication flows. You can theme every login screen to match your brand, and the built-in account console gives end users a self-service portal to manage their own credentials and active sessions.

Keycloak is powerful but not lightweight. First-time setup is non-trivial and the documentation assumes you already know IAM concepts. For simpler setups, Authentik is a leaner alternative, but Keycloak’s depth, ecosystem maturity, and CNCF backing make it the default choice when auth is central to what you’re building. Deployment runs through Docker, Kubernetes, or bare-metal with no licensing cost for self-hosted use.