# Keycloak

> Apache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP

**Category:** Next.js  
**Pricing:** open-source  
**URL:** https://www.keycloak.org  
**GitHub:** https://github.com/keycloak/keycloak  
**Added:** 2026-09-03

---

## The Hook

Keycloak is the CNCF IdP the JVM shops already run — not authentik with a different coat.

## What's Good

Apache-2.0. CNCF incubation. OpenID Connect, OAuth 2.0, SAML 2.0, LDAP user federation, identity brokering. Admin console, realms, clients. Self-host is the product.

## The Catch

CNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.

## Verdict

Apache-2.0 CNCF IdP. Heavy, complete, self-host. Not authentik.