Keycloak Hosting

How Keycloak works

Keycloak sits between users and the applications they need to access. Administrators create realms, register clients, define redirect addresses, configure roles, and choose authentication flows. Applications then use OpenID Connect, OAuth 2.0, or SAML to delegate sign-in rather than implementing every login function independently.

Identity brokering can send users to an external OpenID Connect or SAML provider, while user federation can connect supported directory services such as LDAP or Active Directory. The administration console manages users, groups, sessions, clients, scopes, role mappings, and realm settings from one place.

Key Keycloak features

Single sign-on lets one authenticated session serve several compatible applications. Fine-grained client and role settings control which identities can reach each service. Themes customise user-facing pages, and authentication flows can combine passwords, one-time credentials, passkeys, external providers, and other configured steps.

Central identity also creates a concentrated security responsibility. Redirect URIs, client secrets, federation connections, administrator accounts, token lifetimes, and signing keys must be governed carefully. A configuration error can affect several applications at once, so changes should be tested in a separate realm before broad use.

Keycloak vs Auth0

Keycloak is a self-hosted identity and access-management server with standards-based protocols, realm administration, user federation, and identity brokering. Auth0 is a cloud identity platform offering hosted login, SSO, social and passwordless methods, MFA, machine-to-machine access, and vendor-operated infrastructure.

Auth0 may suit teams that want the provider to operate the identity platform and expose managed security features through a commercial service. Keycloak is more appropriate when the organisation needs direct control of identity data and configuration, provided it can operate and audit a security-critical service.

Who uses Keycloak

Software teams use Keycloak as the identity provider for internal tools, customer portals, APIs, and multi-application environments. Larger organisations connect directories or external providers, while development teams use separate realms to isolate products, environments, or customer groups.

The service is not a substitute for access governance. Administrators still need policies for privileged accounts, client registration, role review, credential recovery, session limits, federation failures, and emergency access.

Self-hosting Keycloak: requirements and cost

Resource use grows with realms, clients, users, active sessions, token issuance, authentication complexity, federation traffic, event logging, and administrative activity. PostgreSQL stores realms, users, clients, roles, sessions, and configuration. The database is included but unmanaged, and its memory is outside the exported application minimum.

AvaHost recommends Plan 4 at €20 for the complete Keycloak stack after the database adjustment. One-click deployment, a custom identity domain, automated HTTPS, automatic application updates, and scheduled backups are included. Application email is disabled, so verification, forgot-password, and administrator action messages cannot be sent; realms must be designed without dependence on those flows.