{"slug": "keycloak", "name": "Keycloak", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 11, "warners": 2, "score": 2.474, "rising": 0.35, "first": "2025-11-03", "latest": "2026-10-23", "why": "Or just stick with KeyCloak that offers a full self hosted product...", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 5, "compare": 1, "warn": 2}, "spark": [0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "Or just stick with KeyCloak that offers a full self hosted product...", "icon": true, "domain": "keycloak.org", "github_repo": null, "official_url": "https://www.keycloak.org", "pricing": "", "aliases": ["Keycloak"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 791809600, "item_id": 49488100, "url": "https://news.ycombinator.com/item?id=49488100", "by": "DarmokTanagra", "date": "2026-08-29", "stance": "recommend", "quote": "You should take a look at their client adapters, thats what I use.", "excerpt": "You should take a look at their client adapters, thats what I use. https://www.keycloak.org/securing-apps/javascript-adapter", "context": "", "use_case": "authentication with custom frontend", "switched_from": "", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 781147840, "item_id": 48821740, "url": "https://news.ycombinator.com/item?id=48821740", "by": "andix", "date": "2026-07-07", "stance": "recommend", "quote": "Keycloak is awesome, but whenever I used it the documentation gave me too little guidance.", "excerpt": "Keycloak is awesome, but whenever I used it the documentation gave me too little guidance. On how to use it in the right way, without having to customize it too much.", "context": "", "use_case": "authentication", "switched_from": "", "story": "Better Auth is joining Vercel"}, {"id": 778735792, "item_id": 48670987, "url": "https://news.ycombinator.com/item?id=48670987", "by": "v5v3", "date": "2026-06-25", "stance": "recommend", "quote": "Or just stick with KeyCloak that offers a full self hosted product...", "excerpt": "\"Ory Enterprise License: Unlock enterprise-grade features like security SLAs for CVEs, SAML, B2B organizations, multi-tenancy, and better scalability.\" [0] Or just stick with KeyCloak that offers a full self hosted product... [1] [0]https://github.com/ory [1]https://www.keycloak.org/", "context": "", "use_case": "self-hosted auth", "switched_from": "", "story": "Cloudflare launched self-managed OAuth for all"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 803269648, "item_id": 50204353, "url": "https://news.ycombinator.com/item?id=50204353", "by": "pamcake", "date": "2026-10-23", "stance": "warn", "quote": "The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link.", "excerpt": "> A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by direct", "context": "", "use_case": "identity and access management", "switched_from": "", "story": "Keycloak: Unauthenticated account takeover via reset-credentials flow bypass"}, {"id": 768734928, "item_id": 48045933, "url": "https://news.ycombinator.com/item?id=48045933", "by": "jillesvangurp", "date": "2026-05-06", "stance": "warn", "quote": "If you've ever used Keycloak, Spring Security, or similarly convoluted solutions, you know what I'm talking about.", "excerpt": "This sounds like moving the problem, not solving it. I've been doing server based systems since forever and sso is this big complicated topic where people seem to bias to using either really complicated and convoluted enterprise solutions or some walled garden with lots of limitations. In both cases you are buying into somebody else's solution. That complex framework is complex because the company behind it threw eve", "context": "has built server systems and implemented SSO, OAuth, OIDC", "use_case": "SSO / auth", "switched_from": "", "story": "From Supabase to Clerk to Better Auth"}]}], "who": [{"by": "bengalister", "context": "self-hoster", "url": "https://news.ycombinator.com/item?id=50122291", "date": "2026-10-16"}, {"by": "jabrotapu", "context": "freelancer building on-prem GPU clusters", "url": "https://news.ycombinator.com/item?id=49661006", "date": "2026-09-11"}], "tags": [], "use_cases": ["authentication", "identity and access management", "idp broker and sso", "self-hosted identity", "multi-tenant single sign-on", "authentication with custom frontend"], "compared": [{"slug": "ory", "name": "Ory", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "kubernetes", "name": "Kubernetes", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "prometheus", "name": "Prometheus", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "auth0", "name": "Auth0", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "better-auth", "name": "Better Auth", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "grafana", "name": "Grafana", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50109715", "title": "What I self-host", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49478091", "title": "I used AWS cognito for a startup. I wouldn't do it again", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48038827", "title": "From Supabase to Clerk to Better Auth", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50204334", "title": "Keycloak: Unauthenticated account takeover via reset-credentials flow bypass", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49522905", "title": "Ask HN: Freelancer? Seeking freelancer? (September 2026)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48819512", "title": "Better Auth is joining Vercel", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {"neutral": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {"warn": 1, "compare": 1}, "2026-06": {"recommend": 1}, "2026-07": {"recommend": 1}, "2026-08": {"neutral": 1, "recommend": 1}, "2026-09": {"neutral": 1}, "2026-10": {"neutral": 1, "warn": 1}}, "quotes": [{"id": 803269648, "item_id": 50204353, "url": "https://news.ycombinator.com/item?id=50204353", "by": "pamcake", "date": "2026-10-23", "stance": "warn", "quote": "The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link.", "excerpt": "> A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by direct", "context": "", "use_case": "identity and access management", "switched_from": "", "story": "Keycloak: Unauthenticated account takeover via reset-credentials flow bypass"}, {"id": 801956656, "item_id": 50122291, "url": "https://news.ycombinator.com/item?id=50122291", "by": "bengalister", "date": "2026-10-16", "stance": "neutral", "quote": "I use it only as id (idp) broker and SSO to authenticate to my apps.", "excerpt": "I use it only as id (idp) broker and SSO to authenticate to my apps. I don't have a use case that requires sharing identity across applications. It is definitely overkill for now, I could have used a password manager and a browser extension.", "context": "self-hoster", "use_case": "IdP broker and SSO", "switched_from": "", "story": "What I self-host"}, {"id": 801839491, "item_id": 50114968, "url": "https://news.ycombinator.com/item?id=50114968", "by": "bengalister", "date": "2026-10-16", "stance": "neutral", "quote": "keycloak", "excerpt": "I also self host some services: keycloak, forgejo, home assistant, immich, grafana/prometheus, jellyfin, pureftp (to store my surveillance cameras videos), and a vibecoded financial app, and soon hermes agent on a 2023 laptop. I chose to run most of them on Kubernetes since I am used to work with it. I use: - ha-proxy running on the host and istio running inside the cluster for the sni based ingress routing - cert-ma", "context": "homelab self-hoster, works with Kubernetes", "use_case": "self-hosted identity", "switched_from": "", "story": "What I self-host"}, {"id": 794576099, "item_id": 49661006, "url": "https://news.ycombinator.com/item?id=49661006", "by": "jabrotapu", "date": "2026-09-11", "stance": "neutral", "quote": "Keycloak SSO", "excerpt": "SEEKING WORK | India, remote | Part-time | Overlap with US, UK, EU hours I build on-prem GPU clusters and private AI apps that run entirely on the client's own hardware, so their data never leaves the building. About 10 years full-stack, the last few on GPU infrastructure. Currently running a live production cluster: 700-800 users sharing a small physical GPU pool. GPU-backed JupyterHub, single sign-on, per-user quot", "context": "freelancer building on-prem GPU clusters", "use_case": "multi-tenant single sign-on", "switched_from": "", "story": "Ask HN: Freelancer? Seeking freelancer? (September 2026)"}, {"id": 791809600, "item_id": 49488100, "url": "https://news.ycombinator.com/item?id=49488100", "by": "DarmokTanagra", "date": "2026-08-29", "stance": "recommend", "quote": "You should take a look at their client adapters, thats what I use.", "excerpt": "You should take a look at their client adapters, thats what I use. https://www.keycloak.org/securing-apps/javascript-adapter", "context": "", "use_case": "authentication with custom frontend", "switched_from": "", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 791695696, "item_id": 49480981, "url": "https://news.ycombinator.com/item?id=49480981", "by": "sceptic123", "date": "2026-08-28", "stance": "neutral", "quote": "We've been using Keycloak for a while, it's definitely not bad, but there are times when it's been frustrating", "excerpt": "We've been using Keycloak for a while, it's definitely not bad, but there are times when it's been frustrating, and getting it both stable and scalable seem to be incompatible goals. It's super powerful and can do whatever you want it to do (at least if you are comfortable writing Java SPI). But there's a lot of knowledge of how to set things up that takes time and is not readily acquired. For the record we looked at", "context": "", "use_case": "identity provider", "switched_from": "", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 781147840, "item_id": 48821740, "url": "https://news.ycombinator.com/item?id=48821740", "by": "andix", "date": "2026-07-07", "stance": "recommend", "quote": "Keycloak is awesome, but whenever I used it the documentation gave me too little guidance.", "excerpt": "Keycloak is awesome, but whenever I used it the documentation gave me too little guidance. On how to use it in the right way, without having to customize it too much.", "context": "", "use_case": "authentication", "switched_from": "", "story": "Better Auth is joining Vercel"}, {"id": 778735792, "item_id": 48670987, "url": "https://news.ycombinator.com/item?id=48670987", "by": "v5v3", "date": "2026-06-25", "stance": "recommend", "quote": "Or just stick with KeyCloak that offers a full self hosted product...", "excerpt": "\"Ory Enterprise License: Unlock enterprise-grade features like security SLAs for CVEs, SAML, B2B organizations, multi-tenancy, and better scalability.\" [0] Or just stick with KeyCloak that offers a full self hosted product... [1] [0]https://github.com/ory [1]https://www.keycloak.org/", "context": "", "use_case": "self-hosted auth", "switched_from": "", "story": "Cloudflare launched self-managed OAuth for all"}, {"id": 768830994, "item_id": 48051937, "url": "https://news.ycombinator.com/item?id=48051937", "by": "joekrill", "date": "2026-05-07", "stance": "compare", "quote": "It's super straight-forward to implement compared with similar products (Ory Kratos, Keycloak, etc).", "excerpt": "> Better Auth checked a lot of boxes right out of the gate: high code quality, Maybe I have high standards, but I absolutely would not describe Better Auth as having \"high code quality\". It has certainly been improving, but when I first looked at this project it felt really rushed and thrown together, with little automated tests. There's was virtually no logging last I looked, so there's little options to monitor wha", "context": "", "use_case": "authentication", "switched_from": "", "story": "From Supabase to Clerk to Better Auth"}, {"id": 768734928, "item_id": 48045933, "url": "https://news.ycombinator.com/item?id=48045933", "by": "jillesvangurp", "date": "2026-05-06", "stance": "warn", "quote": "If you've ever used Keycloak, Spring Security, or similarly convoluted solutions, you know what I'm talking about.", "excerpt": "This sounds like moving the problem, not solving it. I've been doing server based systems since forever and sso is this big complicated topic where people seem to bias to using either really complicated and convoluted enterprise solutions or some walled garden with lots of limitations. In both cases you are buying into somebody else's solution. That complex framework is complex because the company behind it threw eve", "context": "has built server systems and implemented SSO, OAuth, OIDC", "use_case": "SSO / auth", "switched_from": "", "story": "From Supabase to Clerk to Better Auth"}, {"id": 754417137, "item_id": 47151071, "url": "https://news.ycombinator.com/item?id=47151071", "by": "retired", "date": "2026-02-25", "stance": "neutral", "quote": "A national government is large enough to run their own Keycloak instance", "excerpt": "Is there a European alternative to Microsoft 365? Most platforms like Nextcloud focus on file storage, email, documents and video conference but don't do anything similar to the identity management, provisioning, policies and SSO that Office 365 provides. A national government is large enough to run their own Keycloak instance but a regional branch of government would be better off with having a SaaS for that. It wou", "context": "", "use_case": "identity management", "switched_from": "", "story": "Danish Gov agency to ditch Microsoft software in push for digital independence"}, {"id": 732817233, "item_id": 45801077, "url": "https://news.ycombinator.com/item?id=45801077", "by": "jw_cook", "date": "2025-11-03", "stance": "neutral", "quote": "OIDC integration (currently using it with Keycloak)", "excerpt": "The article mentions Vikunja as an alternative to Nextcloud Tasks, and I can give it a solid recommendation as well. I wanted a self-hosted task management app with some lightweight features for organizing tasks into projects, ideally with a kanban view, but without a full-blown PM feature set. I tried just about every task management app out there, and Vikunja was the only one that ticked all the boxes for me. Some ", "context": "", "use_case": "OIDC login for Vikunja", "switched_from": "", "story": "Why Nextcloud feels slow to use"}]}