Do I need a domain name for Keycloak?

Yes. Keycloak signs its tokens and builds its OIDC and SAML redirects from its public HTTPS address, so it must answer on a stable name. No need to buy one: every ServOrbit VPS comes with a free subdomain (keycloak.{dns_slug}.servorbit-dns.com) with an HTTPS certificate. You can also use a subdomain of one of your domains.

Where do I find the administrator password?

It is shown in your client area, on the page of the installed application; the username is admin. It opens the administration console of the master realm. Keycloak flags it as a temporary account: create your own administrator, then disable this one.

How much RAM should I plan for?

Keycloak runs on the JVM: expect about 600 MB at idle together with its PostgreSQL database. A 2 GB VPS is enough to start; move to 4 GB if several realms receive traffic or other applications share the server.

How do I back up and update Keycloak?

Accounts, realms, clients and persistent sessions live in the PostgreSQL database, stored in the keycloak-pgdata volume: back it up with pg_dump before every update. To upgrade, change the Keycloak image tag in the application's docker-compose.yml, then run docker compose pull and docker compose up -d; Keycloak migrates its schema on startup.

Harden infrastructure security.

Keycloak

Keycloak — open-source enterprise SSO on your VPS: OIDC, SAML 2.0, realms, LDAP federation and MFA, with no per-user licence.

2 GB minimum RAM 2 vCPU Port 8105 In validation

In validation

Automatic installation for this solution is ready and currently going through our tests on a real server. Ordering will open as soon as validation is complete.

Source code

Tech stack

DockerKeycloakPostgreSQL 17

Minimum RAM2 GB minimum

Minimum CPU2 vCPU

Default port8105

Compatible OSChoice of Linux distributions

Keycloak is the open-source identity provider (Apache 2.0 licence) backed by Red Hat and the Cloud Native Computing Foundation. It centralises sign-in for your applications: one account, one login page, and OpenID Connect tokens or SAML 2.0 assertions that your applications verify without handling passwords themselves. Realms isolate each customer or environment, federation connects an existing LDAP or Active Directory, and brokering enables sign-in through Google, GitHub, Microsoft or another OIDC provider.

Hosting it on your VPS keeps your users' accounts, their sessions and your audit logs on a server you control, with no billing per active user. Keycloak suits teams building in Java, Spring Boot, Node.js, PHP or .NET who want standard SSO, and companies that must prove where their identity data lives.

Key features

OpenID Connect, OAuth 2.0 and SAML 2.0 — one server for your web and mobile apps, APIs and internal tools.

Realms — isolated identity spaces, each with its own users, clients, roles and login page.

Directory federation — connect an existing LDAP or Active Directory without migrating accounts.

Sign-in through an external provider — Google, GitHub, Microsoft or any OIDC or SAML provider.

Strong authentication — OTP, WebAuthn and passkeys, password policies, brute-force detection.

Roles, groups and fine-grained authorisation — permissions carried in the token, read by your apps with no extra request.

When to use this solution?

1

One SSO for all your internal tools

Your teams sign in once and reach Grafana, Gitea, Nextcloud or your business apps. Offboarding means disabling a single account, not one per tool.

2

Authentication for your SaaS application

Your Spring Boot, Node.js or Laravel application delegates sign-in, registration, password reset and MFA to Keycloak, and only has to verify an OIDC token.

3

One realm per customer

An agency or software vendor isolates each customer in its own realm, with a branded login page and, if needed, federation of the customer's Active Directory.

Deploy Keycloak on your VPS

Guide optimized for ServOrbit Cloud VPS.

01

Create the VPS and choose the address

Order an Ubuntu 24.04 VPS with at least 2 GB of RAM, 4 GB if several realms receive traffic. Keycloak requires a domain: it signs its tokens and builds its OIDC and SAML redirects from its public HTTPS address. It opens on a subdomain of one of your domains, or on the VPS's free subdomain (keycloak.{dns_slug}.servorbit-dns.com), HTTPS included. No need to buy a domain name.

02

Install Keycloak from the Marketplace

In your client area, select Keycloak, choose the address and click Install. The script deploys Keycloak and its PostgreSQL database in Docker, keeps the data in a dedicated volume and configures the nginx reverse proxy over HTTPS.

03

Sign in for the first time

Open https://your-domain/admin and sign in with the username admin and the password shown in your client area ("Reveal" button). This master-realm account is a temporary administrator: create your own administrator account with the admin role right away, then disable the original admin account.

04

Create a realm for your applications

Keep the master realm for administration only. Create a dedicated realm ("Create realm"), set its password policy, enable brute-force detection and, if needed, MFA with OTP or passkeys.

05

Connect your first application

In the realm, add an OpenID Connect client, declare your application's redirect URLs and copy its secret. The discovery address to enter in the application is https://your-domain/realms/<your-realm>/.well-known/openid-configuration.

Frequently asked questions

Keycloak is the most complete and the most widely used in enterprises: SAML 2.0, LDAP and Active Directory federation, realms, fine-grained authorisation, and native integration with Spring Boot and most frameworks. Authentik and ZITADEL are lighter and easier to get started with. Choose Keycloak if you need SAML, must federate an existing directory or follow a standard your customers already use.

Complementary solutions

Cybersecurity & Bastion

Keycloak isn't orderable yet.