Keycloak alternatives and IAM platforms, compared

Keycloak alternatives fall into three groups: IAM suites, supported or managed Keycloak, and other open-source IAM projects. Authorization engines sit beside an identity provider. Keymate keeps Keycloak and adds authorization on every request, on your own infrastructure. This page compares each, including where they fit better than Keymate.

Book a demo Keymate vs Keycloak

Three kinds of IAM product, and where Keymate sits

Identity and access management software comes in three shapes, and most shortlists mix them.

IAM suites.
One product for directories, sign-in, MFA and often identity governance, usually run by the vendor in its cloud: Okta, Microsoft Entra ID, Ping Identity.
Open-source IAM and its hosts.
Keycloak and Zitadel are open-source identity and access management (IAM) projects you run yourself. Red Hat sells a supported Keycloak build, and managed Keycloak providers run it for you.
Standalone authorization engines.
They decide who may do what, from policies outside application code, but sign no one in, so they run beside an identity provider: PlainID, Cerbos, Permit.io.

Keymate brings the two together: Keycloak for sign-in and an authorization engine's per-request decisions, in one authorization-first IAM platform you host yourself.

Three ways to cover identity and authorization

	Typical IAM suite	Standalone authorization engine	Keymate
Identity and sign-in	Included, often with identity governance	From a separate identity provider	Included, on Keycloak, with joiners, movers and leavers from HR events
Authorization model	Roles and groups	Policies outside application code	Policies: who may do what, under which conditions
Enforcement	At sign-in and token issue; some add a gateway	Your application calls the decision point	Gateway, API gateway, service mesh, SDKs, Kafka
Changing a rule	Admin console or API	Policy as code, often versioned	Versioned, with rollback; optional approver
Proving compliance	Sign-in logs, access reviews	Decision logs	Every decision with its policy version
Where it runs	Mostly the vendor's cloud	Decision point yours; management often vendor-hosted	Your Kubernetes; air-gapped (Enterprise); no managed service

IAM suites: Okta, Microsoft Entra ID, Ping Identity

Okta

An identity platform delivered as a cloud service run by Okta: a directory, single sign-on, MFA, identity governance, privileged access and a fine-grained authorization service. It suits organizations that want the vendor to operate identity. Its strengths include access requests, certifications and separation-of-duties rules, AI-agent identity, and more than 8,000 prebuilt integrations in the Okta Integration Network (checked 17 October 2026). The service runs in Okta's cloud; Okta Access Gateway is the part deployed in your own environment, and it applies path-level rules for sign-in rather than asking a decision point per action and resource.

Full comparison: Keymate vs Okta

Microsoft Entra ID

Microsoft's cloud identity service, formerly Azure Active Directory, covering workforce users and guests, sign-in and Conditional Access, identity governance, and identities for workloads and AI agents. It suits organizations already licensed for Microsoft 365, where Entra ID tiers come with the plan. Its strengths include Conditional Access with Continuous Access Evaluation, Entra ID Governance, and integration with Microsoft 365, Azure, Intune and Defender. Entra enforces at sign-in, at token level and at network level, not as a per-request, resource-level decision point in the request path, and it is a cloud service that stores identity and access data in a Microsoft geography chosen at sign-up.

Full comparison: Keymate vs Microsoft Entra ID

Ping Identity

An identity vendor with two product lines: the PingOne cloud and self-managed software (PingFederate, PingAccess, PingAuthorize, PingDirectory and Ping Advanced Identity Software). It suits organizations that want one vendor for both. PingAuthorize is a central decision point that keeps policy versions you can roll back, separates authors from deployers and explains decisions in its Decision Visualizer; Ping Identity Governance runs certifications, access requests and segregation of duties. Ping describes that governance as cloud-native, and its site claims no self-managed edition of it. Ping offers a 30-day trial, not a free tier.

Full comparison: Keymate vs Ping Identity

Keycloak and Red Hat build of Keycloak

Keycloak

A free, open-source IAM project under the Apache License 2.0, incubating at the CNCF, with single sign-on, OIDC, OAuth 2.0, SAML, federation, MFA and built-in Authorization Services. Keymate is built on it. It suits teams that want a standards-complete identity foundation with no license cost and are ready to run it themselves. The project publishes no support policy or long-term support release, so upgrades and security patches are the operator's job, and enforcement is wired in per application, with no bundled API gateway.

Full comparison: Keymate vs Keycloak

Red Hat build of Keycloak

What it is. Red Hat's commercially supported build of the open-source Keycloak project, generally available since November 2023 and the replacement for Red Hat Single Sign-On.

Strong at. A published support lifecycle (at least 2 years for 26.x, at least 3 years for 27.x and later), operator-based deployment on OpenShift with supported zero-downtime patch releases, and FIPS-aware release engineering.

Consider it if. You are standardized on Red Hat or OpenShift and want Keycloak with vendor support, including a move off Red Hat Single Sign-On.

Limits. No standalone price: it comes through Red Hat subscriptions. You run it yourself; Red Hat offers no managed service for it. Multi-site deployment requires Red Hat Data Grid, and new community features arrive later, in a later supported release, a choice Red Hat makes for stability.

Managed Keycloak: Phase Two and Cloud-IAM

Managed Keycloak providers run Keycloak for you, so the operating work on the Keycloak card becomes the provider's job.

Phase Two

What it is. Managed hosting for Keycloak on a dedicated cluster, support for Keycloak you run yourself, and B2B extensions: organizations, self-service SSO setup, an admin portal, magic link login and event webhooks.

Strong at. Multi-tenancy inside one realm, with organization roles, invitations and domain-based routing; customers connect their own SAML or OIDC provider through setup wizards; unlimited registered users on every plan; SOC 2 Type II and ISO 27001 certification.

Consider it if. You build SaaS or platform products and want Keycloak with B2B organizations, without running the servers.

Limits. Authorization relies on organization roles and attributes mapped into tokens; the application still makes and enforces the access decision. No free hosted tier, and uptime SLAs start with the Premium plan.

Cloud-IAM

What it is. A managed Keycloak service from France that runs unmodified upstream Keycloak, with SLA-backed hosting, upgrades and support.

Strong at. No proprietary fork, the full Admin REST API, Terraform and Pulumi automation, ISO 27001:2022 certification, a permanent free tier and a choice of cloud provider on the paid single-region tiers.

Consider it if. You want Keycloak without operating it, or need hosting on the Outscale cloud, where Cloud-IAM lists SecNumCloud 3.2 and HDS as "Compliant".

Limits. Authorization is what upstream Keycloak provides. SecNumCloud 3.2 and HDS cover Outscale only and the multi-region tier runs on AWS only, so the published plans cannot combine them.

Open source identity: Zitadel

Zitadel

What it is. An open-source identity platform (OIDC, SAML, SCIM, passkeys, machine users) written from scratch in Go. It is not based on Keycloak.

Strong at. Multi-tenancy as a core concept (Organizations, Projects, project grants and delegated managers), REST and gRPC APIs with an official Terraform provider, and a choice of self-hosting or Zitadel's cloud with data residency in the EU, the US, Switzerland or Australia.

Consider it if. You are building a new, API-driven identity layer, especially for B2B SaaS products whose customers manage their own organizations.

Limits. Authorization is role- and grant-based, with no built-in fine-grained policy engine or enforcement point. LDAP works as a login source only, with no directory sync, and PostgreSQL is the only supported database since v3.

Standalone authorization engines: PlainID, Cerbos, Permit.io

PlainID

What it is. A commercial, policy-based authorization platform that sits beside your identity provider and decides what users, services and AI agents may do across applications, APIs and data.

Strong at. Authorization for data platforms such as Databricks and Snowflake, a simulator with audit for testing decisions before release, AI-agent authorization with MCP integrations, and a wide integration list: API gateways such as Apigee, AWS API Gateway, Azure API Management and Kong, plus Istio.

Consider it if. You are a large enterprise, especially in financial services, with an identity provider and API gateways already in place.

Limits. Not an identity provider. Enforcement runs through Authorizers in components you already run, and current materials describe policy management as a PlainID-hosted SaaS service; confirm current options with PlainID if management must stay on your premises.

Cerbos

What it is. An open-core authorization engine: applications ask the Cerbos policy decision point (PDP) whether an action is allowed, under YAML policies kept outside the code.

Strong at. Policy as code with test suites and SDKs in eight languages. Cerbos Hub adds a pipeline that builds and tests each change, versioned deployments with rollback, aggregated decision logs and decision lineage.

Consider it if. Your developers build microservices or multi-tenant SaaS, already have an identity provider and want authorization out of application code.

Limits. No login, MFA or user lifecycle. Every enforcement point is an integration, through the SDKs, the API or Cerbos Synapse.

Permit.io

What it is. A developer-first authorization platform: a cloud control plane for policies, no-code or as policy as code over OPA/Rego, with a decision point you run next to your application.

Strong at. RBAC, ABAC and ReBAC with a self-serve start and a free tier; a local decision point that keeps answering if Permit's cloud is unreachable; open-source OPAL; and an MCP Gateway that checks AI-agent tool calls against policy.

Consider it if. You build SaaS or B2B applications and already have an identity provider.

Limits. Not an identity provider for people. The control plane is a cloud service by default, with on-premises deployment on the Enterprise plan. Enforcement happens in your code or in gateways you already run; Permit does not ship its own API gateway.

Keymate, with its own limits

Keymate runs identity and sign-in on Keycloak, decides authorization on every request and enforces it in the request path, all on infrastructure you control. You can require an approver before a policy change takes effect. Its limits:

Self-hosted only. There is no managed service. If you want the vendor to run identity for you, a suite or a managed Keycloak provider fits better.
Identity Governance covers joiners, movers and leavers today, driven by HR events through API-based connectors. Keymate does not run certification campaigns, segregation-of-duties rules or an access request catalog today.
No prebuilt connector catalog on the scale of a suite. Keymate relies on standard protocols (OIDC, SAML), Keycloak's extension points and API-based identity connectors.

Enterprise IAM platform comparison: where each one runs

Every cell comes from the vendor's public material, checked on 17 October 2026. Spotted something out of date? Tell us and we will fix it.

Product	Runs on your infrastructure	Run by the vendor	License
Okta	Access Gateway only	Yes	Commercial, proprietary
Microsoft Entra ID	Domain Services and connectors only	Yes	Commercial, proprietary
Ping Identity	Yes, self-managed software line	Yes (PingOne)	Commercial, proprietary
Keycloak	Yes	Not documented	Apache 2.0
Red Hat build of Keycloak	Yes, customer-operated	No	Red Hat subscription
Phase Two	On-premises on a custom plan	Yes	Extensions under Elastic License v2 (source available)
Cloud-IAM	No self-hosted edition published	Yes	Commercial service on upstream Keycloak
Zitadel	Yes	Yes	AGPL-3.0 core; commercial license on Enterprise
PlainID	Decision point; ask PlainID about management	Policy management	Commercial, proprietary
Cerbos	Decision point; Hub on Enterprise	Cerbos Hub	Apache 2.0 decision point; commercial Hub
Permit.io	Decision point; control plane on Enterprise	Control plane	Commercial; OPAL and decision point Apache-2.0
Keymate	Every component	No	Own license, free edition up to 100 registered users; not open source

Product
Okta
Runs on your infrastructure
Access Gateway only
Run by the vendor
Yes
License
Commercial, proprietary
Product
Microsoft Entra ID
Runs on your infrastructure
Domain Services and connectors only
Run by the vendor
Yes
License
Commercial, proprietary
Product
Ping Identity
Runs on your infrastructure
Yes, self-managed software line
Run by the vendor
Yes (PingOne)
License
Commercial, proprietary
Product
Keycloak
Runs on your infrastructure
Yes
Run by the vendor
Not documented
License
Apache 2.0
Product
Red Hat build of Keycloak
Runs on your infrastructure
Yes, customer-operated
Run by the vendor
No
License
Red Hat subscription
Product
Phase Two
Runs on your infrastructure
On-premises on a custom plan
Run by the vendor
Yes
License
Extensions under Elastic License v2 (source available)
Product
Cloud-IAM
Runs on your infrastructure
No self-hosted edition published
Run by the vendor
Yes
License
Commercial service on upstream Keycloak
Product
Zitadel
Runs on your infrastructure
Yes
Run by the vendor
Yes
License
AGPL-3.0 core; commercial license on Enterprise
Product
PlainID
Runs on your infrastructure
Decision point; ask PlainID about management
Run by the vendor
Policy management
License
Commercial, proprietary
Product
Cerbos
Runs on your infrastructure
Decision point; Hub on Enterprise
Run by the vendor
Cerbos Hub
License
Apache 2.0 decision point; commercial Hub
Product
Permit.io
Runs on your infrastructure
Decision point; control plane on Enterprise
Run by the vendor
Control plane
License
Commercial; OPAL and decision point Apache-2.0
Product
Keymate
Runs on your infrastructure
Every component
Run by the vendor
No
License
Own license, free edition up to 100 registered users; not open source

Choosing by requirement

A self-hosted IAM platform.
Keymate runs every component on your infrastructure, including policy management, the decision point and the evidence store. The table above shows the others.
An air-gapped identity platform.
Keymate runs on your Kubernetes, air-gapped if you need it (Enterprise). Cerbos describes its decision point as air-gap compatible; for the others, ask the vendor.
A sovereign identity platform in Europe.
Check where each component runs and where data and evidence stay. Cloud-IAM (France) and Zitadel offer European hosting, and Microsoft Entra ID stores data in a geography chosen at sign-up. Keymate keeps every component on your infrastructure and claims no sovereignty certification.
An identity platform for regulated industries.
Ask for the evidence an auditor accepts, not only certifications. Okta (FedRAMP High for government), Phase Two (SOC 2 Type II, ISO 27001) and Cloud-IAM (ISO 27001) publish theirs; the development of Keymate is certified to ISO 27001:2022. Keymate also records who changed each policy, any approval behind the change, and every decision it made.
An open-source IAM platform.
Keycloak (Apache License 2.0) and Zitadel (AGPL-3.0 core) are open source; Cerbos and Permit.io publish open-source parts. Keymate is not open source: it has a free edition under its own license, and Pricing shows what each edition includes.
Someone to run Keycloak for you.
Phase Two and Cloud-IAM are managed Keycloak providers. Keymate is not a hosting service.

Questions

What are the alternatives to Keycloak?

The alternatives to Keycloak fall into three groups: a supported or managed Keycloak (Red Hat build of Keycloak, Phase Two, Cloud-IAM), an IAM suite (Okta, Microsoft Entra ID, Ping Identity) or another open-source IAM project such as Zitadel. Authorization engines such as PlainID, Cerbos and Permit.io do not replace Keycloak; they sit beside it. Keymate is built on Keycloak rather than replacing it, as Keymate vs Keycloak explains.

What are the managed Keycloak providers?

Managed Keycloak providers run Keycloak for you, with hosting, upgrades and support. Phase Two hosts Keycloak on a dedicated cluster with its own B2B extensions, and also supports Keycloak you run yourself; Cloud-IAM runs unmodified upstream Keycloak on the cloud provider you choose. Red Hat build of Keycloak is supported but not managed: Red Hat offers no managed service for it. Keymate is not a managed Keycloak host: it is a product built on Keycloak that you run yourself.

What are the alternatives to PlainID that can be self-hosted?

A self-hosted alternative runs policy management on your own infrastructure as well as the decision point. Cerbos and Permit.io (on their Enterprise plans) and Keymate do; Keymate also covers identity and sign-in. PlainID runs its decision engine in your environment, but its current materials describe policy management as PlainID-hosted, so ask PlainID about on-premises management.

What is the best self-hosted identity and access management platform?

No self-hosted IAM platform is best for every case. Compare them on four points: whether access is decided on every request or only at login, where decisions are enforced, how a rule change is approved and rolled back, and what evidence you can hand an auditor. For on-premise identity and access management, Keycloak, Red Hat build of Keycloak, Zitadel and Keymate run wholly on your own infrastructure. Ping Identity's software line does too, except identity governance, and Phase Two offers on-premises deployment on a custom plan.

What tools provide authorization governance?

Authorization governance comes down to four controls: an approval step you can require before a policy goes live, a dry run of the change against real past decisions, rollback to any version, and a decision record tied to the policy version in force. Cerbos Hub documents versioned deployments with rollback and decision lineage; PingAuthorize documents version history with rollback, separate authors and deployers, policy testing and decision explanation; PlainID documents a simulator with audit. Keymate's Authorization Governance module covers all four.

What are the best identity orchestration platforms for companies that need strong federation and SAML support?

Compare them on protocol coverage (SAML, OIDC and, where you need it, WS-Federation) and on how users from other organizations sign in. Platforms with strong federation and SAML support include Ping Identity (PingFederate), Microsoft Entra ID (SAML, OIDC and WS-Federation), Zitadel, and Keycloak with the products built on it, such as Red Hat build of Keycloak, Phase Two, Cloud-IAM and Keymate. Keymate runs federation on Keycloak and sends each organization's users to that organization's own identity provider. Authentication covers the details.

Check Keymate against your own requirements.