What is Keycloak?
Keycloak is a well-known open-source Identity and Access Management (IAM) solution based on Java allows websites, applications, portals and services to authenticate and authorize users. It enables the administration of users, authorizations and roles and can be deployed both on-premises (locally on servers) and in the cloud.
Due to its open-source nature, it is obvious that the software stack is developed, maintained, bug-fixed by the community, and can be used free of charge. Despite this fact, Keycloak serves as the foundation for the renowned commercial offering “Red Hat Single Sign-On” now “Red Hat Build”. At the same time, users themselves are responsible for operating and updating both Keycloak itself as well as the underlying infrastructure. Additionally, the user must take care of implementing customizations and adaptations. While Keycloak is often used in smaller deployments, users often complain about the limited scalability, which usually only becomes apparent as challenges grow during the course of use.
Keycloak offers a basic and stable set of IAM features around Single Sign-On comprising:
- Basic functions with customization capabilities, e.g., for registration, login, password reset.
- Possibilities to add or change factors.
- Single-Sign-On functionality,
- Passwordless authentication,
- One-time Password (TOTP, HOTP),
- Multi-factor Authentication,
- Supports authentication protocols OpenID Connect, SAML 2.0, OAuth 2.0,
- WebAuthn (FIDO2 Passkeys, U2F Smartcards),
- LDAP (Lightweight Directory Access Protocol),
- Limited multi-tenancy functionality.
Keycloak also offers the ability to customize it for specific needs via plugins.
Are there any drawbacks to using Keycloak?
While Keycloak is a popular open-source library for Identity and Access Management, it does come with certain drawbacks that users should be aware of. One of the main limitations is that Keycloak does not offer any cloud service or managed services. This means that users are responsible for setting up and maintaining their own infrastructure. The managers responsible for the setup often report a very manual and complicated setup process that requires a lot of expertise.
On the one hand, Keycloak itself has to be set up and, on the other hand, your own applications have to be integrated and configured into the Keycloak ecosystem. A misconfiguration can have serious consequences for operation and security. Maintenance tasks can also quickly become very challenging if you don’t have the necessary resources, technical know-how, and experience.
Another drawback is the lack of official customer support for Keycloak software. As typical with open-source projects, users must rely on community support, which may not always be readily available or timely. Forums or online communities may offer some help and assistance. Professional support from specialized consultancies, however, is costly and potentially difficult to get if needed in an emergency case.
Keycloak is primarily designed as an authentication and authorization solution, which means that its feature set may be limited compared to more comprehensive identity management platforms. Users looking for advanced features such as customization, true multi-tenancy, or reliable zero-downtime deployments may find Keycloak itself lacking (e.g. Magic Links) in these areas. Some of this additional functionality may be made available by using third-party add-ons. Yet their integration demands patience and can require significant development work as the user has to try them out in their own environment until they are properly working. In particular, branding one’s own Keycloak solution with logos, texts, colors, language, and other customizations, or setting up rule sets and access rights for groups, special B2B scenarios, is hardly straightforward.
What’s more, scalability can be a concern with Keycloak. While it can handle small to medium-sized deployments effectively, larger-scale implementations (e.g., a couple of hundreds of realms) or directories may require additional configuration and optimization, may lead to a resource hungry environment and slow speed, or do not work at all. Furthermore, multi-tenancy in a B2B environment does not exist and can only be achieved to some extend by utilizing workarounds with independent realms (directories/branches).
It’s important to consider these drawbacks when evaluating whether Keycloak is the right solution for your specific needs. While it offers flexibility and customization options as an open-source library, users should carefully assess their requirements and consider alternative solutions if they require cloud services, managed services, extensive support, future-proof scalability, or a broader range of features.
Next level Keycloak or Hosted Keycloak Services
Over time, as more and more customers requested an integrated managed operations model, some providers decided to support Keycloak users with an end-to-end Keycloak as-a-service model including operations and support. Consequently, the formerly open-source and free solution mutated to a paid model that nevertheless only tackles some of the disadvantages. Even though the drawbacks related to missing operations and support were eliminated, many other drawbacks rameain, such as limited scalability, a small feature set, or only basic customization capabilities.
If you decide to use a hosted Keycloak service, please also make sure to check the GDPR-compliance of the service.
Keycloak: The Right Choice for You?
Keycloak is the perfect choice for organizations looking to build, adopt, and maintain their own Identity and Access Management (IAM) system based on an open-source software stack. The main pre-exquisite is that your organization has enough capable and available engineering and security experts to implement, manage, and support the company’s IAM set-up. As part of this, you should be ready to host your IAM solution yourself or look for a provider to do so. Other important factors you should consider, are
- whether Keycloak offers all the features your organization needs in the specific way, your organization needs it,
- how much you want to grow in future, as Keycloak is not easy to scale,
- and how much you want to customize your solution.
In conclusion, Keycloak is a great solution for a limited number of use cases. However, if you do not have an experienced engineering and security team with free capacity available and do not exactly know about your future needs, it might be better to partner with a professional IAM provider, such as Engity.
The Comfortable Keycloak Alternative: Consider a Fully Integrated Cloud Based IAM Solution
The best alternative to the open-source Keycloak solution is a fully integrated and cloud native Identity and Access Management solution offering end-to-end service. Such an authentication solution should include at least the following features:
- Full feature set of all standard authentication methods, e.g., password, passwordless via Magic Link, SMS or Biometrics, Single Sign-on as well as Social Login functionality, multi-factor authentication, etc.,
- Standard built-in security set, e.g., prevention of detection of who is using a
- Service, strong password checker, breached password detection, lock-out functionality
- Managed services including regular updates, bug-fixes and uploading of security patches,
- Target group specific operational model, e.g., for corporates or for the Mittelstand, start-ups and grown-ups,
- Future-proof through unlimited scalability,
- Various levels of support,
- Wide variety of branding and customization options across login screen, domains, access rules as well as grouping functionalities,
- Availability of customized solutions for special customer use cases, e.g., allowing user registration without existence of e-mails for all users or access solutions for non-digital people,
- GDPR-compliance and guaranteed hosting on European servers.
Engity is such a fully integrated cloud based IAM provider with a special focus on the European Mittelstand, start-ups as well as grown-ups. Furthermore, Engity has invented the so-called environment technology to support the flexible roll-out of various use cases within one database or directory. For more information about Engity’s product offering, please visit our homepage.
What are the Differences between Keycloak & fully integrated cloud based IAM solutions?
Keycloak and fully integrated IAM vendors, e.g., Engity, have completely different approaches and philosophies about how to tackle online authentication, its operations, software support, scalability as well as further development of new features (e.g. environment technologies, login without personal email) and ease of use and implementation.
Keycloak is an open-source project that relies on a community to update, bugfix and further develop the code. It provides the user with a limited unmanaged feature set with only modest scalability and only without warranties, operations, maintenance and support and legal compliance services. To run Keycloak successfully, a user needs deep knowledge of authentication and security services or must hire an experienced & expensive consultancy to set up and run the IAM environment for them.
In contrast, professional IAM-providers support their customers not only with a feature-rich and innovative feature set but also provide a hassle-free end-to-end cloud-based operational model including hosting, maintenance, bug-fixing, and support. Additionally, users should consider the long term (GDPR-)compliance fo the solution they chose.
From our point of view, these are clear differentiators that make Engity as fully integrated IAM provider the better alternative than using Keycloak itself.
Conclusion
The above blog article has shown that fully integrated IAM solutions are often the better alternative to using self-hosted open-source Keyclock software. And even though Keycloak can be considered a mature solution for user authentication and single sign-on, the support is limited, scalability is restricted, and the implementation of corporate branding is not that easy either. If you would like to discuss further how to use Engity as an Keycloak alternative or how a migration path might look like, get in touch with our IAM experts today and start planning your seamless migration.
Note: This article was first published in December 2023 and last updated and corrected in June 2025.