Compare / Keycloak
IdRa vs Keycloak.
Keycloak: open source, LDAP built in, and you run it. IdRa: open source too, hosted for you, and free up to 100 users.
2023Keycloak accepted to the CNCF, at the Incubating level
26.8Keycloak’s SCIM API promoted from preview to supported
$0IdRa, hosted, up to 100 users, apps and servers
The short version.
Choose IdRa if
- You’d rather not run identity servers: IdRa is hosted at idra.team
- You’re leaving Okta and have scripts written against its API
- You want each organization in its own Postgres database
- You want threat feeds, device checks and posture findings in the same product
What you get
- Hosting at idra.team, or your own infrastructure
- An open source codebase under the MIT license
- An Okta-compatible API at
/api/v1 - Eleven authenticators, from passkeys to RSA SecurID
Side by side.
Every Keycloak cell links to the page it came from. IdRa’s side comes from reading its code.
| Capability | Keycloak | IdRa | What you get |
|---|---|---|---|
| How it’s delivered | |||
| Running it yourself | Yours to run. The getting-started guide begins with docker run and Keycloak’s container image. Getting started | Included | Hosted at idra.team, or one Bun process and Postgres on your own infrastructure. |
| Source code | Open source identity and access management. A CNCF Incubating project, accepted on April 10, 2023. keycloak.org CNCF project page | Included | Open source under the MIT license, on GitHub. |
| Separating tenants | Realms, which are isolated from one another. Server admin guide | Included | Each organization has its own Postgres database, address and signing keys. |
| Sign-on | |||
| Protocols | OpenID Connect, OAuth 2.0 and SAML. keycloak.org | Included | OIDC and OAuth 2.1, and we run the OpenID conformance suite ourselves, with no failures. SAML 2.0. |
| Single sign-out | Single sign-on with single sign-out. keycloak.org | Included | OIDC back-channel logout and global sign-out. SAML Single Logout when the app starts it. |
| External identity providers | Identity brokering with OIDC or SAML 2.0 providers, and social login. keycloak.org | Included | OIDC and SAML providers, with Google and Microsoft presets. |
| Directory and authentication | |||
| SCIM | APIs for managing users and groups within a realm. Supported since 26.8. Release notes Server admin guide | Included | Inbound for users and groups, with PATCH and deprovisioning. Outbound create, update, deactivate, reactivate, opt-in delete and group push. |
| Authenticators | Passkey, password or X.509 to sign in. Passkey, recovery codes and TOTP/HOTP for a second factor. Server admin guide | Included | Eleven authenticators, including passkeys, TOTP, push, SMS, YubiKey OTP and Duo. |
| Running day to day | |||
| Admin console | Administrators centrally manage all aspects of the server. keycloak.org | Included | An admin console for people, apps, policies and the log, with 12 built-in roles and custom roles limited to a set of groups and apps. |
| Self-service for users | An account console where users manage their own accounts. keycloak.org | Included | My Apps, plus settings for sign-in methods and devices. |
| Audit events | Audit streams that admins can view and hook into. Server admin guide | Included | Search, filters, CSV export, an API and signed event hooks. |
| Fine-grained authorization | Authorization services, for when role-based authorization doesn’t cover your needs. keycloak.org | Included | Authorization servers, scopes and access policies for APIs, and sign-in rules per app. |
| Changing the look | Themes that change the appearance of any UI, per realm. Server admin guide | Included | One brand per organization, with its own emails. |
Keycloak’s facts come from the pages linked above. Fetched October 30 and 31, 2026. Details change, so check Keycloak’s current documentation.
Common questions.
Do I have to run IdRa myself?
No. IdRa is hosted at idra.team, and you can also run it yourself.
Can I read IdRa’s source code?
Yes. It’s open source under the MIT license, on GitHub.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.
