Compare / Keycloak
IdRa vs Keycloak.
Keycloak: open source, LDAP built in, and you run it. IdRa: hosted and free today.
2023Keycloak accepted to the CNCF, at the Incubating level
26.8Keycloak’s SCIM API promoted from preview to supported
$0IdRa, hosted, with nothing to install
The short version.
Choose IdRa if
- You’d rather not run identity servers: IdRa is hosted at idra.team
- You’re leaving Okta and have scripts written against its API
- You want each organization in its own Postgres database
- You want threat feeds, device checks and posture findings in the same product
Choose Keycloak if
- You need LDAP or Active Directory federation today
- You need the source code today, or to run it on your own infrastructure
- You need several replicas in a high-availability architecture
Side by side.
Every Keycloak cell links to the page it came from. If we couldn’t find a fact on Keycloak’s own pages, the row isn’t here. IdRa’s side comes from reading its code.
| Capability | Keycloak | IdRa | IdRa today |
|---|---|---|---|
| How it’s delivered | |||
| Running it yourself | Yours to run. The getting-started guide begins with docker run and Keycloak’s container image. Getting started | On the roadmap | Hosted at idra.team. On your own infrastructure once the repository is public. |
| Source code | Open source identity and access management. A CNCF Incubating project, accepted on April 10, 2023. keycloak.org CNCF project page | On the roadmap | Private today, with no license yet. |
| High availability | Can be deployed in a number of high-availability architectures, chosen by the administrator. High availability guide | On the roadmap | One replica today. |
| Separating tenants | Realms, which are isolated from one another. Server admin guide | Included | Each organization has its own Postgres database, address and signing keys. |
| Sign-on | |||
| Protocols | OpenID Connect, OAuth 2.0 and SAML. keycloak.org | Included | OIDC and OAuth 2.1, with the conformance suite self-run: 26 of 35 modules passed, 0 failed, not a formal certification. SAML 2.0 tested with SimpleSAMLphp. |
| Single sign-out | Single sign-on with single sign-out. keycloak.org | Partial | OIDC back-channel logout and global sign-out. No SAML Single Logout. |
| External identity providers | Identity brokering with OIDC or SAML 2.0 providers, and social login. keycloak.org | Included | OIDC and SAML providers, with Google and Microsoft presets. No Apple or GitHub. |
| Directory and authentication | |||
| LDAP and Active Directory | Built-in user federation. keycloak.org | Not planned | Skipped deliberately. Needs a separate agent. |
| Kerberos | A bridge that automatically authenticates users logged in to a Kerberos server. Server admin guide | Not planned | No Kerberos sign-in. |
| SCIM | APIs for managing users and groups within a realm. Supported since 26.8. Release notes Server admin guide | Partial | Inbound for users, with PATCH and deprovisioning. Outbound create, update, deactivate, reactivate and group push. |
| Authenticators | Passkey, password or X.509 to sign in. Passkey, recovery codes and TOTP/HOTP for a second factor. Server admin guide | Included | Ten authenticators, including passkeys, TOTP, push, SMS, YubiKey OTP and Duo. Vendor integrations are tested against fakes. |
| Running day to day | |||
| Admin console | Administrators centrally manage all aspects of the server. keycloak.org | Included | An admin console for people, apps, policies and the log, with 12 built-in roles and custom roles limited to a set of groups and apps. |
| Self-service for users | An account console where users manage their own accounts. keycloak.org | Included | My Apps, plus settings for sign-in methods and devices. |
| Audit events | Audit streams that admins can view and hook into. Server admin guide | Included | Search, filters, CSV export, an API and signed event hooks. |
| Fine-grained authorization | Authorization services, for when role-based authorization doesn’t cover your needs. keycloak.org | Partial | Authorization servers, scopes and access policies for APIs, and sign-in rules per app. No general authorization service. |
| Changing the look | Themes that change the appearance of any UI, per realm. Server admin guide | Partial | One brand per organization, with its own emails. English only. |
Keycloak’s price and any hosted offering aren’t compared, because the pages above don’t state them. Fetched October 30 and 31, 2026. Details change, so check Keycloak’s current documentation.
Common questions.
Do I have to run IdRa myself?
No. IdRa is hosted at idra.team. Running it yourself becomes possible once the repository is public.
Does IdRa connect to LDAP or Active Directory?
No, and it’s a deliberate skip. Keycloak has built-in federation with both, so if you depend on them, choose Keycloak.
Can I read IdRa’s source code?
Not yet. Here’s where that stands.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.
