Skip to content

Commit ec38e9e

Browse files
maximthomasmaximthomas
committed
OpenAM vs Keycloak
1 parent 781f5bb commit ec38e9e

File tree

1 file changed

+46
-32
lines changed

1 file changed

+46
-32
lines changed

‎_posts/2025-12-18-openam-vs-keycloak.md‎

Lines changed: 46 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,40 @@
11
---
22
layout: home
3-
landing-title: "OpenAM vs. Keycloak: a Comparative Review"
4-
landing-title2: "OpenAM vs. Keycloak: a Comparative Review"
3+
landing-title: "OpenAM vs Keycloak"
4+
landing-title2: "OpenAM vs Keycloak"
55
description: A detailed comparative review of OpenAM (Open Identity Platform) and Keycloak, two leading open-source identity and access management (IAM) solutions.
66
keywords: 'OpenAM vs Keycloak, Keycloak vs OpenAM, OpenAM comparison, Keycloak comparison, open source IAM, identity access management open source, SSO solutions, single sign-on comparison, OAuth2 OIDC SAML, authentication modules, federation protocols, realms isolation, admin GUI customization, identity repositories, Kubernetes deployment IAM, Open Identity Platform, Red Hat Keycloak, IAM tools 2025, IAM tools 2026, best open source access management'
77
imageurl: 'openam-og.png'
88
share-buttons: true
99
---
1010

11-
# OpenAM vs. Keycloak: a Comparative Review
11+
# OpenAM vs Keycloak
1212

1313
## General Information
1414

15-
---
16-
1715
| | **OpenAM** | **Keycloak** |
1816
| --- | --- | --- |
1917
| Initial release | 2008 | 2014 |
20-
| Maintainer | Open Identity Platform Community | Read Hat |
18+
| Maintainer | Open Identity Platform Community | Red Hat |
2119
| Current version | 16.0.4 | 26.4.7 |
2220
| Release and patches | Regular | Regular |
2321
| Open Source | ✅ | ✅ |
22+
| Programming Language | Java | Java |
23+
| Supported Java version | 11+ LTS | 17+ LTS |
2424
| License | CDDL | Apache License 2.0 |
25+
| Multiple languages supported | ✅ | ✅ |
2526

2627
## Single Sign On (SSO) and Federation
2728

2829
| | OpenAM | Keycloak |
2930
| --- | --- | --- |
30-
| Applications deplyment behind and auth gateway | ✅ with OpenIG out of the box, third-party vendor gateway | ✅ third-party vendor gateway |
31-
| Policy Agent | ✅ | ⛔️ |
32-
| OAuth 2.0/OIDC federation | ✅ | ✅ |
33-
| SAMLv2 federation | ✅ | ✅ |
31+
| Applications deployment behind an auth gateway | ✅ [doc](https://doc.openidentityplatform.org/openam/deployment-planning/chap-topologies#logical-topology) | ✅ [doc](https://www.krakend.io/docs/authorization/keycloak/) |
32+
| API gateway control | ✅ [doc](https://github.com/OpenIdentityPlatform/OpenAM/wiki/How-to-Add-Authorization-and-Protect-Your-Application-With-OpenAM-and-OpenIG-Stack) | ⛔️ |
33+
| Apache Web Server Policy Agent | ✅ [doc](https://doc.openidentityplatform.org/openam/web-users-guide/chap-apache) | ⛔️ |
34+
| IIS Policy Agent | ✅ [doc](https://doc.openidentityplatform.org/openam/web-users-guide/chap-msiis-7) | ⛔️ |
35+
| J2EE Policy Agent (for Tomcat, Jetty, etc) | ✅ [doc](https://doc.openidentityplatform.org/openam/jee-users-guide/) | ⛔️ |
36+
| OAuth 2.0/OIDC federation | ✅ [Google example](https://www.keycloak.org/docs/latest/server_admin/index.html#_github)| ✅ [GitHub example](https://www.keycloak.org/docs/latest/server_admin/index.html#_github) |
37+
| SAMLv2 federation | ✅ [WordPress example](https://github.com/OpenIdentityPlatform/OpenAM/wiki/SAML-Authentication-in-WordPress-via-OpenAM)| ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_github) |
3438

3539
### Authentication
3640

@@ -40,11 +44,11 @@ Supported authentication methods:
4044
| --- | --- | --- |
4145
| Login and password authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#data-store-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_authentication-flows) |
4246
| Microsoft Active Directory authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#active-directory-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_user-storage-federation) |
43-
| Authentication for demo access | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#anonymous-module-ref) | ⛔️ |
47+
| Authentication for demo access | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#anonymous-module-ref) | ⛔️ |
4448
| Adaptive authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#adaptive-risk--module-ref) | ⛔️ |
4549
| Authentication in an LDAPv3-compatible directory | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#ldap-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_user-storage-federation) |
4650
| Persistent cookie authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#persistent-cookie-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#enabling-remember-me) |
47-
| RDMS authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#jdbc-module-ref) | ✅ [doc](https://www.keycloak.org/server/db) |
51+
| RDBMS authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#jdbc-module-ref) | ✅ [doc](https://www.keycloak.org/server/db) |
4852
| Self-registration | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#membership-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#con-user-registration_server_administration_guide) |
4953
| HTTP Header enrichment authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#msisdn-module-ref) | ⛔️ |
5054
| Windows NT authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#windows-nt-module-ref) | ⛔️ |
@@ -54,66 +58,76 @@ Supported authentication methods:
5458
| RADIUS authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#radius-module-ref) | ⛔️ |
5559
| HOTP via SMS or email | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#hotp-module-ref) | ⛔️ |
5660
| One time password with HOTP or TOTP authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#oath-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#one-time-password-otp-policies) |
57-
| Custom Scripted authentication module | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#scripted-module-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#script-authenticator) |
61+
| Custom scripted authentication provider | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#scripted-module-module-ref) | ⛔️ |
5862
| SAMLv2 authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#saml2-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_saml) |
5963
| ReCaptcha | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#recaptcha-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#proc-enabling-recaptcha_server_administration_guide) |
60-
| WebAuthn | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#webauthn-registration-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#webauthn_server_administration_guide) |
6164
| QR-code authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#qr-code-confirm-from-other-session-module-ref) | ⛔️ |
6265
| NTLM authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#ntlm-module-ref) | ⛔️ |
6366
| Docker HTTP Basic Authentication | ⛔️ | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#docker-authentication-flow) |
6467
| HTTP Basic Authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#http-basic-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#docker-authentication-flow) |
6568
| Recovery codes authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/admin-guide/chap-auth-services#authn-mfa-accessing-recovery-codes) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_recovery-codes) |
6669
| WebAuthn | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#webauthn-registration-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#webauthn_server_administration_guide) |
6770
| X509 certificate authentication | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-auth-modules#certificate-module-ref) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_x509) |
71+
| Custom authentication provider| ✅ [doc](https://doc.openidentityplatform.org/openam/dev-guide/chap-customizing#sec-auth-spi) | ✅ [doc](https://www.keycloak.org/docs/latest/server_development/index.html#implementing-an-authenticator) |
72+
6873

6974
## Isolation (realms)
7075

71-
Realm support for identities and authentication processes isolation
76+
Realm support for isolation of identities and authentication processes
7277

7378
| | **OpenAM** | **Keycloak** |
7479
| --- | --- | --- |
75-
| Realms support | ✅ | ✅ |
80+
| Realms support | ✅ [doc](https://doc.openidentityplatform.org/openam/admin-guide/chap-realms) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#_configuring-realms) |
7681
| Realm hierarchy | ✅ | ⛔️ |
7782

7883
## Interfaces
7984

80-
| **Intefrace** | OpenAM | **Keycloak** |
85+
| **Interface** | **OpenAM** | **Keycloak** |
8186
| --- | --- | --- |
8287
| Administrator GUI | ✅ | ✅ |
8388
| Admin REST API | ✅ | ✅ |
84-
| Admin UI customization | ⚠️ technically possible but requires significant effort | ✅ [doc](https://www.keycloak.org/ui-customization/creating-your-own-console) |
89+
| Admin UI customization | ⛔️ | ✅ [doc](https://www.keycloak.org/ui-customization/creating-your-own-console) |
8590
| Authentication GUI | ✅ | ✅ |
8691
| Authentication GUI customization | ✅ [doc](https://doc.openidentityplatform.org/openam/install-guide/chap-custom-ui) | ✅ [doc](https://www.keycloak.org/guides#ui-customization) |
8792
| Authentication REST API | ✅ [doc](https://doc.openidentityplatform.org/openam/dev-guide/chap-client-dev#sec-rest) | ⛔️ |
93+
| Authentication XML-RPC API | ✅ [doc](https://doc.openidentityplatform.org/openam/dev-guide/chap-client-dev#sec-sdk) | ⛔️ |
8894

89-
## Authentication sessions
95+
## Authentication Sessions
9096

91-
| | OpenAM | Keycloak |
97+
| | **OpenAM** | **Keycloak** |
9298
| --- | --- | --- |
93-
| Stateful | ✅ random symbol sequence | ✅ JWT |
94-
| Stateless | ✅ JWT | ✅ JWT |
95-
| Security Token Service | ✅  | ✅ |
99+
| [Stateful][1] | Random session ID | JWT |
100+
| [Stateless][1] | JWT | JWT |
101+
| REST Security Token Service | ✅  | ✅ |
102+
| SOAP Security Token Service | ✅  | ⛔️ |
103+
104+
[1]:https://github.com/OpenIdentityPlatform/OpenAM/wiki/Stateful-vs-Stateless-Authentication
105+
96106

97107
## Identity Repositories
98108

99109
| Repository type | **OpenAM** | **Keycloak** |
100110
| --- | --- | --- |
101-
| LDAP (OpenDJ, OpenLDAP и т.д.) | ✅  | ✅  |
111+
| LDAP (OpenDJ, OpenLDAP, etc.) | ✅  | ✅  |
102112
| Active Directory | ✅  | ✅  |
103113
| Apache Cassandra | ✅  | ⛔️ |
104-
| MariaDB Server | ✅  | ✅ |
105-
| Microsoft SQL Server | ✅  | ✅ |
114+
| MariaDB Server | ✅ | ✅ |
115+
| Microsoft SQL Server | ✅ | ✅ |
106116
| MySQL | ✅  | ✅ |
107117
| Oracle Database | ✅  | ✅ |
108118
| PostgreSQL | ✅  | ✅ |
119+
| Flat file | ✅  | ⛔️ |
120+
| Custom identity repository | ✅ [doc](https://doc.openidentityplatform.org/openam/dev-guide/chap-customizing#sec-identity-repo-spi)  | ✅ [doc](https://www.keycloak.org/docs/latest/server_development/index.html#_user-storage-spi) |
109121

110-
## Architecture and Deployment
111122

112-
| | OpenAM | Keycloak |
123+
## Audit logging and Monitoring
124+
125+
| | **OpenAM** | **Keycloak** |
113126
| --- | --- | --- |
114-
| Kubernetes support | ⚠️ StatefulSet using Docker container | ✅ Kubernetes Operator |
115-
| Has state | Stateful | Stateless |
116-
| Replication between nodes | ✅  | ⛔️ |
127+
| Audit Logging | ✅ [doc](https://doc.openidentityplatform.org/openam/reference/chap-audit-log-messages) | ✅ [doc](https://www.keycloak.org/docs/latest/server_admin/index.html#configuring-auditing-to-track-events) |
128+
| HTTP-based Monitoring| ✅ [doc](https://doc.openidentityplatform.org/openam/admin-guide/chap-monitoring#monitoring-web-pages) | ✅ [doc](https://www.keycloak.org/server/management-interface) |
129+
| SNMP Monitoring | ✅ [doc](https://doc.openidentityplatform.org/openam/admin-guide/chap-monitoring#monitoring-snmp) | ⛔️ |
130+
| JMX Monitoring | ✅ [doc](https://doc.openidentityplatform.org/openam/admin-guide/chap-monitoring#monitoring-jmx) | ⛔️ |
117131

118132
## Useful Links
119133

@@ -127,4 +141,4 @@ Realm support for identities and authentication processes isolation
127141

128142
- [Official website](https://www.keycloak.org/)
129143
- [GitHub repository](https://github.com/keycloak/keycloak)
130-
- [Documentation](https://www.keycloak.org/documentation)
144+
- [Documentation](https://www.keycloak.org/documentation)

0 commit comments

Comments
 (0)