Keycloak

Keycloak is the default answer when you need OIDC and SAML, a user federation layer, and an admin surface that other teams can operate — without writing an authorization server yourself. It joined the CNCF as an incubating project in 2023, and the 25.0 release (June 2024) is the cleanest it has ever been to run on Kubernetes: the WildFly distribution is gone, health and metrics moved off the public port, and hostname configuration was rebuilt. ...

Most teams that need an identity operation Keycloak doesn’t ship — “resolve this user’s effective entitlements in one call”, “let a user accept updated terms”, “expose a tenant-scoped lookup” — build a separate microservice. That service then has to validate Keycloak’s tokens, hold a service-account credential to call the Admin REST API, reconstruct realm and group logic over HTTP, and get deployed, scaled, and monitored as its own thing. It’s a lot of moving parts to add one endpoint. ...

Every enterprise has one: a Java EE application that has quietly earned its keep for a decade. It builds into an EAR, it wants an application server you download as a ZIP, it authenticates with a form and a j_security_check, and it imports everything from javax.*. It works. Nobody wants to touch it. And it is exactly the kind of thing that becomes impossible to deploy the day someone asks for “just put it in a container on OpenShift.” ...