Is there something simpler than Keycloak?

Keycloak can do nearly everything an identity system needs, which is why it can feel like a lot. If all you want is one login for a few apps, you may not want to look after a Java server, a database, realms, clients and a theme engine. There are simpler options, self-hosted and hosted. Which one is simpler for you depends on the protocols you need and on whether you want to run a server at all.

What is Keycloak good at?#

Keycloak is an open-source identity and access management server, written in Java on the Quarkus framework and licensed under Apache 2.0. It joined the Cloud Native Computing Foundation (CNCF), the foundation that also hosts Kubernetes, as an incubating project on 10 April 2023.

Keycloak covers a lot in one server:

• Standard protocols: OpenID Connect, OAuth 2.0 and SAML 2.0. SAML (Security Assertion Markup Language) is the XML-based single sign-on standard that many enterprise systems still require.
• User federation with Active Directory and other LDAP (Lightweight Directory Access Protocol) directories.
• Identity brokering: social logins and other OIDC or SAML providers, set up in the admin console.
• Self-service: an account console where people change passwords, set up two-factor sign-in and manage their sessions.
• Fine-grained authorization for rules that go beyond roles.

If you need SAML for enterprise customers, LDAP federation and full control on your own servers, Keycloak remains a strong choice. Red Hat also sells a supported version, the Red Hat build of Keycloak.

Why does Keycloak feel heavy?#

Most of the weight is in operating Keycloak, not in what it does:

• Running it. Production mode won’t start without a hostname and TLS. The built-in dev-file database is for development only, so you run PostgreSQL, MySQL, MariaDB, Oracle or SQL Server next to it. Several nodes share state through distributed caches built on Infinispan.
• Upgrading it. Keycloak shipped four releases between 16 September and 13 October 2026. Each upgrade means reviewing the migration changes, upgrading adapters and client libraries, and retesting custom providers.
• Realms and clients. A realm is an isolated set of users, credentials, roles and groups. A client is an application that asks Keycloak to sign someone in. Add client scopes, protocol mappers and authentication flows, and a simple “log in to my app” touches many screens of the admin console.
• Themes. Login pages are Apache FreeMarker templates. Keycloak’s own guide warns that templates you override may need updating when you upgrade.
• The database. Sizing, backups and restores are yours.

None of this is a flaw. It is the cost of a general-purpose server that you control.

What are simpler self-hosted options?#

“Simpler” can mean fewer features, a friendlier admin UI or a lighter runtime. All of these projects are open source:

• Zitadel is written in Go and stores its data in PostgreSQL. It is OpenID Connect certified and supports SAML 2.0, passkeys, LDAP as a login source and SCIM 2.0, with organizations built in for B2B apps. It is licensed under AGPL-3.0, and Zitadel Cloud runs the same code as a hosted service.
• authentik is written mostly in Python. It speaks OAuth 2.0 and OIDC, SAML, LDAP and RADIUS, and its proxy provider can put a login in front of apps that have none. The company behind it offers no hosted version.
• Authelia is a Go server that adds single sign-on and two-factor sign-in to apps behind a reverse proxy such as NGINX, Traefik, Caddy or HAProxy. It is also an OpenID Connect provider. Users come from a YAML file or from LDAP, and SAML is on its roadmap, not shipped.
• Logto is written in TypeScript and runs on Node.js with PostgreSQL. It covers OIDC, OAuth 2.1 and SAML, with organizations and role-based access control. Logto Cloud is the hosted version, and the open-source edition has a single admin account.
• Ory is a set of Go services: Kratos for accounts and sessions, Hydra for OAuth 2.0 and OIDC, Keto for permissions and Polis for SAML. Ory is headless, so you build the login screens yourself. Ory Network is the hosted version.
• Dex is a small Go service that issues OIDC tokens and passes sign-ins on to identity sources you already have, through connectors for LDAP, SAML 2.0, GitHub and other OIDC providers. It is a CNCF sandbox project, and its docs include a Kubernetes guide.
• Casdoor, from the Casbin community, is a Go server with a React admin console. It supports OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP, SCIM 2.0, WebAuthn and TOTP.

What about hosted options?#

If the heavy part is operations, a hosted provider removes it. You keep standard protocols and hand off servers, upgrades and backups, in exchange for less control and a bill that depends on the plan.

• Managed Keycloak. Companies such as Phase Two and Cloud-IAM run, upgrade and back up Keycloak for you, so your realms and themes keep working.
• Hosted versions of the projects above: Zitadel Cloud, Logto Cloud and Ory Network.
• Large identity platforms. Auth0 offers SAML enterprise connections and reaches on-premises Active Directory through a connector you install. Microsoft Entra External ID, which replaced Azure AD B2C for new customers in May 2025, supports OIDC and SAML apps. Amazon Cognito federates with SAML, OIDC and social providers.
• Developer-focused services like Clerk and WorkOS, with organizations and SAML for B2B apps.

The Auth0 alternatives page compares the hosted side in more depth.

SAML connections, custom domains and higher limits often depend on the plan, so compare each vendor’s pricing page.

Where loginos fits#

loginos is the no-ops option: a hosted OpenID Connect provider with no server, database, realm or theme to look after. You create a platform in the developer console, add your domains, and point any OIDC library at https://loginos.io/.well-known/openid-configuration.

loginos fits when:

• Your product runs on many domains that should share one user pool. You add domains in the console, from your server up to 1,000 at a time, or as verified wildcards like *.example.com.
• You want passkeys without building them. Passkeys belong to loginos.io, so they work on all your domains.
• You want roles and permissions in every token, defined once per platform.
• You already have users. They link their old account once, and every token then carries your user id as external_id.
• Cost matters: loginos has no paid plans today.

loginos doesn’t fit when you need:

• Self-hosting or source code: loginos is hosted only.
• SAML, LDAP or Active Directory federation, or SCIM provisioning.
• Social logins, SMS or TOTP codes, or organizations and tenants inside one platform.
• A login page on your own domain. Sign-in always happens on loginos.io, showing your platform’s name and logo.
• Verified email addresses: loginos doesn’t verify email yet.

For those needs, Keycloak or one of the projects above is the better tool. For other hosted choices, see free OpenID Connect providers. If you are moving a simple Keycloak setup, most concepts map directly:

Frequently asked questions#

Is Keycloak a CNCF project?#

Yes. Keycloak joined the Cloud Native Computing Foundation on 10 April 2023 at the incubating maturity level, and the project still describes itself as a CNCF incubation project. Dex, also in this comparison, has been a CNCF sandbox project since June 2020.

Which Keycloak alternatives support SAML?#

Zitadel, authentik, Logto and Casdoor support SAML 2.0, Ory adds it through Ory Polis, and Dex can use a SAML identity provider as a login source. Authelia lists SAML as planned. Among hosted services, Auth0, Microsoft Entra External ID, Amazon Cognito, Clerk and WorkOS support SAML, often on specific plans. loginos doesn’t support SAML.

Is Keycloak free?#

Yes. Keycloak is open source under the Apache 2.0 license, with no license fee. You pay instead for the servers, the database and the time to run and upgrade them, or for a managed provider or Red Hat’s supported build.

Is Keycloak overkill for a small app?#

Often, if the app only needs password or passkey sign-in and one login across a few sites. A hosted OpenID Connect provider, or a smaller server like Zitadel or Logto, gets you there with less to run. Keycloak earns its weight when you need SAML, LDAP federation, custom authentication flows or strict control over where the data lives.