|
| 1 | +--- |
| 2 | +layout: home |
| 3 | +landing-title: "OpenAM vs. Keycloak: a Comparative Review" |
| 4 | +landing-title2: "OpenAM vs. Keycloak: a Comparative Review" |
| 5 | +description: A detailed comparative review of OpenAM (Open Identity Platform) and Keycloak, two leading open-source identity and access management (IAM) solutions. |
| 6 | +keywords: 'OpenAM vs Keycloak, Keycloak vs OpenAM, OpenAM comparison, Keycloak comparison, open source IAM, identity access management open source, SSO solutions, single sign-on comparison, OAuth2 OIDC SAML, authentication modules, federation protocols, realms isolation, admin GUI customization, identity repositories, Kubernetes deployment IAM, Open Identity Platform, Red Hat Keycloak, IAM tools 2025, IAM tools 2026, best open source access management' |
| 7 | +imageurl: 'openam-og.png' |
| 8 | +share-buttons: true |
| 9 | +--- |
| 10 | + |
| 11 | +# OpenAM vs. Keycloak: a Comparative Review |
| 12 | + |
| 13 | +## General Information |
| 14 | + |
| 15 | +--- |
| 16 | + |
| 17 | +| | **OpenAM** | **Keycloak** | |
| 18 | +| --- | --- | --- | |
| 19 | +| Initial release | 2008 | 2014 | |
| 20 | +| Maintainer | Open Identity Platform Community | Read Hat | |
| 21 | +| Current version | 16.0.4 | 26.4.7 | |
| 22 | +| Release and patches | Regular | Regular | |
| 23 | +| Open Source | ✅ | ✅ | |
| 24 | +| Лицензия | CDDL | Apache License 2.0 | |
| 25 | + |
| 26 | +## Single Sign On (SSO) and Federation |
| 27 | + |
| 28 | +| | OpenAM | Keycloak | |
| 29 | +| --- | --- | --- | |
| 30 | +| Applications deplyment behind and auth gateway | ✅ with OpenIG out of the box, third-party vendor gateway | ✅ third-party vendor gateway | |
| 31 | +| Policy Agent | ✅ | ⛔️ | |
| 32 | +| OAuth 2.0/OIDC federation | ✅ | ✅ | |
| 33 | +| SAMLv2 federation | ✅ | ✅ | |
| 34 | + |
| 35 | +### Authentication |
| 36 | + |
| 37 | +Supported authentication methods: |
| 38 | + |
| 39 | +| **Модуль аутентификации** | **OpenAM** | **Keycloak** | |
| 40 | +| --- | --- | --- | |
| 41 | +| Login and password authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#data-store-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_authentication-flows) | |
| 42 | +| Microsoft Active Directory authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#active-directory-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_user-storage-federation) | |
| 43 | +| Authentication for demo access | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#anonymous-module-ref) | ⛔️ | |
| 44 | +| Adaptive authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#adaptive-risk--module-ref) | ⛔️ | |
| 45 | +| Authentication in an LDAPv3-compatible directory | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#ldap-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_user-storage-federation) | |
| 46 | +| Persistent cookie authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#persistent-cookie-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#enabling-remember-me) | |
| 47 | +| RDMS authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#jdbc-module-ref) | ✅ [doc](https://www.keycloak.org/server/db) | |
| 48 | +| Self-registration | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#membership-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#con-user-registration_server_administration_guide) | |
| 49 | +| HTTP Header enrichment authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#msisdn-module-ref) | ⛔️ | |
| 50 | +| Windows NT authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#windows-nt-module-ref) | ⛔️ | |
| 51 | +| OAuth 2.0/OIDC authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#oauth-2) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#con-oidc_server_administration_guide) | |
| 52 | +| Kerberos authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#windows-desktop-sso-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_kerberos) | |
| 53 | +| OIDC id_token authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#openid-connect-id_token-bearer-module-ref) | ⛔️ | |
| 54 | +| RADIUS authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#radius-module-ref) | ⛔️ | |
| 55 | +| HOTP via SMS or email | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#hotp-module-ref) | ⛔️ | |
| 56 | +| One time password with HOTP or TOTP authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#oath-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#one-time-password-otp-policies) | |
| 57 | +| Custom Scripted authentication module | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#scripted-module-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#script-authenticator) | |
| 58 | +| SAMLv2 authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#saml2-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_saml) | |
| 59 | +| ReCaptcha | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#recaptcha-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#proc-enabling-recaptcha_server_administration_guide) | |
| 60 | +| WebAuthn | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#webauthn-registration-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#webauthn_server_administration_guide) | |
| 61 | +| QR-code authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#qr-code-confirm-from-other-session-module-ref) | ⛔️ | |
| 62 | +| NTLM authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#ntlm-module-ref) | ⛔️ | |
| 63 | +| Docker HTTP Basic Authentication | ⛔️ | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#docker-authentication-flow) | |
| 64 | +| HTTP Basic Authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#http-basic-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#docker-authentication-flow) | |
| 65 | +| Recovery codes authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/admin-guide/chap-auth-services#authn-mfa-accessing-recovery-codes) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_recovery-codes) | |
| 66 | +| WebAuthn | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#webauthn-registration-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#webauthn_server_administration_guide) | |
| 67 | +| X509 certificate authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#certificate-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_x509) | |
| 68 | + |
| 69 | +## Isolation (realms) |
| 70 | + |
| 71 | +Realm support for identities and authentication processes isolation |
| 72 | + |
| 73 | +| | **OpenAM** | **Keycloak** | |
| 74 | +| --- | --- | --- | |
| 75 | +| Realms support | ✅ | ✅ | |
| 76 | +| Realm hierarchy | ✅ | ⛔️ | |
| 77 | + |
| 78 | +## Interfaces |
| 79 | + |
| 80 | +| **Intefrace** | OpenAM | **Keycloak** | |
| 81 | +| --- | --- | --- | |
| 82 | +| Administrator GUI | ✅ | ✅ | |
| 83 | +| Admin REST API | ✅ | ✅ | |
| 84 | +| Admin UI customization | ⚠️ technically possible but requires significant effort | ✅ [doc](https://www.keycloak.org/ui-customization/creating-your-own-console) | |
| 85 | +| Authentication GUI | ✅ | ✅ | |
| 86 | +| Authentication GUI customization | ✅ [doc](https://doc.openidentityplatform.org/openam/install-guide/chap-custom-ui) | ✅ [doc](https://www.keycloak.org/guides#ui-customization) | |
| 87 | +| Authentication REST API | ✅ [doc](https://doc.openidentityplatform.org/openam/dev-guide/chap-client-dev#sec-rest) | ⛔️ | |
| 88 | + |
| 89 | +## Authentication sessions |
| 90 | + |
| 91 | +| | OpenAM | Keycloak | |
| 92 | +| --- | --- | --- | |
| 93 | +| Stateful | ✅ random symbol sequence | ✅ JWT | |
| 94 | +| Stateless | ✅ JWT | ✅ JWT | |
| 95 | +| Security Token Service | ✅ | ✅ | |
| 96 | + |
| 97 | +## Identity Repositories |
| 98 | + |
| 99 | +| Repository type | **OpenAM** | **Keycloak** | |
| 100 | +| --- | --- | --- | |
| 101 | +| LDAP (OpenDJ, OpenLDAP и т.д.) | ✅ | ✅ | |
| 102 | +| Active Directory | ✅ | ✅ | |
| 103 | +| Apache Cassandra | ✅ | ⛔️ | |
| 104 | +| MariaDB Server | ✅ | ✅ | |
| 105 | +| Microsoft SQL Server | ✅ | ✅ | |
| 106 | +| MySQL | ✅ | ✅ | |
| 107 | +| Oracle Database | ✅ | ✅ | |
| 108 | +| PostgreSQL | ✅ | ✅ | |
| 109 | + |
| 110 | +## Architecture and Deployment |
| 111 | + |
| 112 | +| | OpenAM | Keycloak | |
| 113 | +| --- | --- | --- | |
| 114 | +| Kubernetes support | ⚠️ StatefulSet using Docker container | ✅ Kubernetes Operator | |
| 115 | +| Has state | Stateful | Stateless | |
| 116 | +| Replication between nodes | ✅ | ⛔️ | |
| 117 | + |
| 118 | +## Useful Links |
| 119 | + |
| 120 | +### OpenAM: |
| 121 | + |
| 122 | +- [Official website](https://www.openidentityplatform.org/openam) |
| 123 | +- [GitHub repository](https://github.com/OpenIdentityPlatform/OpenAM) |
| 124 | +- [Documentation](https://doc.openidentityplatform.org/openam/) |
| 125 | + |
| 126 | +### Keycloak: |
| 127 | + |
| 128 | +- [Official website](https://www.keycloak.org/) |
| 129 | +- [GitHub repository](https://github.com/keycloak/keycloak) |
| 130 | +- [Documentation](https://www.keycloak.org/documentation) |
0 commit comments