#117
A
Rank #7
Keycloak
A full-featured, battle-tested identity and access management server supporting OIDC, SAML, and LDAP federation, originally the base for Red Hat SSO. Standout trait is genuine enterprise-grade IdP capability with proper backend-managed auth and clustering.
87.5
/ 100
⚙ Full Stack
Quarkus-based Java server with Postgres/MySQL as the identity store and optional Infinispan for distributed caching/clustering, exposing REST admin APIs and standard OIDC/SAML endpoints. Ships official images with health/readiness probes built in.
📈 Scaling Analysis
Genuinely scales horizontally — Infinispan-backed clustering lets multiple Keycloak replicas share session/cache state, and it's proven at large enterprise IdP scale. The main cost is JVM memory footprint per replica, not an architectural ceiling.
🚀 Running on Nexlayer
Two-pod minimum — Keycloak app pod and Postgres pod (`postgres.pod:5432`) — with `KC_HOSTNAME` set to the Nexlayer-issued `<% URL %>` domain rather than any hardcoded host, since Keycloak is strict about hostname/issuer matching. Base image pulls through mirror.gcr.io if using the community image mirror.