[{"data":1,"prerenderedAt":113},["ShallowReactive",2],{"seo-verification":3,"marketplace-app-en-keycloak":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"marketplace-app-en-keycloak",{"slug":9,"slugs":10,"categorySlugs":11,"name":16,"description":17,"phase":18,"unavailableReason":19,"docsUrl":20,"logo":21,"github":22,"tagline":23,"longDescription":24,"features":25,"useCases":32,"steps":42,"faq":58,"specs":74,"compatibleOs":85,"relatedApps":86,"relatedPosts":106,"category":110},"keycloak",{"fr":9,"en":9,"ar":9,"es":9},{"fr":12,"en":13,"ar":14,"es":15},"cybersecurity","cybersecurity-bastion","الأمن-السيبراني-والحصن","ciberseguridad-bastion","Keycloak","Open-source identity provider for enterprise SSO: OIDC, SAML 2.0, realms, LDAP and Active Directory federation, sign-in with Google or GitHub.",2,"awaiting_qa","https:\u002F\u002Fservorbit.com\u002Fblog\u002Fdeploy-keycloak-for-sso-on-your-vps","https:\u002F\u002Fcdn.jsdelivr.net\u002Fgh\u002Fselfhst\u002Ficons\u002Fsvg\u002Fkeycloak.svg","https:\u002F\u002Fgithub.com\u002Fkeycloak\u002Fkeycloak","Keycloak — open-source enterprise SSO on your VPS: OIDC, SAML 2.0, realms, LDAP federation and MFA, with no per-user licence.","Keycloak is the open-source identity provider (Apache 2.0 licence) backed by Red Hat and the Cloud Native Computing Foundation. It centralises sign-in for your applications: one account, one login page, and OpenID Connect tokens or SAML 2.0 assertions that your applications verify without handling passwords themselves. Realms isolate each customer or environment, federation connects an existing LDAP or Active Directory, and brokering enables sign-in through Google, GitHub, Microsoft or another OIDC provider.\n\nHosting it on your VPS keeps your users' accounts, their sessions and your audit logs on a server you control, with no billing per active user. Keycloak suits teams building in Java, Spring Boot, Node.js, PHP or .NET who want standard SSO, and companies that must prove where their identity data lives.",[26,27,28,29,30,31],"OpenID Connect, OAuth 2.0 and SAML 2.0 — one server for your web and mobile apps, APIs and internal tools.","Realms — isolated identity spaces, each with its own users, clients, roles and login page.","Directory federation — connect an existing LDAP or Active Directory without migrating accounts.","Sign-in through an external provider — Google, GitHub, Microsoft or any OIDC or SAML provider.","Strong authentication — OTP, WebAuthn and passkeys, password policies, brute-force detection.","Roles, groups and fine-grained authorisation — permissions carried in the token, read by your apps with no extra request.",[33,36,39],{"title":34,"body":35},"One SSO for all your internal tools","Your teams sign in once and reach Grafana, Gitea, Nextcloud or your business apps. Offboarding means disabling a single account, not one per tool.",{"title":37,"body":38},"Authentication for your SaaS application","Your Spring Boot, Node.js or Laravel application delegates sign-in, registration, password reset and MFA to Keycloak, and only has to verify an OIDC token.",{"title":40,"body":41},"One realm per customer","An agency or software vendor isolates each customer in its own realm, with a branded login page and, if needed, federation of the customer's Active Directory.",[43,46,49,52,55],{"title":44,"body":45},"Create the VPS and choose the address","Order an Ubuntu 24.04 VPS with at least 2 GB of RAM, 4 GB if several realms receive traffic. Keycloak requires a domain: it signs its tokens and builds its OIDC and SAML redirects from its public HTTPS address. It opens on a subdomain of one of your domains, or on the VPS's free subdomain (keycloak.{dns_slug}.servorbit-dns.com), HTTPS included. No need to buy a domain name.",{"title":47,"body":48},"Install Keycloak from the Marketplace","In your client area, select Keycloak, choose the address and click Install. The script deploys Keycloak and its PostgreSQL database in Docker, keeps the data in a dedicated volume and configures the nginx reverse proxy over HTTPS.",{"title":50,"body":51},"Sign in for the first time","Open https:\u002F\u002Fyour-domain\u002Fadmin and sign in with the username admin and the password shown in your client area (\"Reveal\" button). This master-realm account is a temporary administrator: create your own administrator account with the admin role right away, then disable the original admin account.",{"title":53,"body":54},"Create a realm for your applications","Keep the master realm for administration only. Create a dedicated realm (\"Create realm\"), set its password policy, enable brute-force detection and, if needed, MFA with OTP or passkeys.",{"title":56,"body":57},"Connect your first application","In the realm, add an OpenID Connect client, declare your application's redirect URLs and copy its secret. The discovery address to enter in the application is https:\u002F\u002Fyour-domain\u002Frealms\u002F\u003Cyour-realm>\u002F.well-known\u002Fopenid-configuration.",[59,62,65,68,71],{"q":60,"a":61},"Keycloak, Authentik or ZITADEL: which one should I choose?","Keycloak is the most complete and the most widely used in enterprises: SAML 2.0, LDAP and Active Directory federation, realms, fine-grained authorisation, and native integration with Spring Boot and most frameworks. Authentik and ZITADEL are lighter and easier to get started with. Choose Keycloak if you need SAML, must federate an existing directory or follow a standard your customers already use.",{"q":63,"a":64},"Do I need a domain name for Keycloak?","Yes. Keycloak signs its tokens and builds its OIDC and SAML redirects from its public HTTPS address, so it must answer on a stable name. No need to buy one: every ServOrbit VPS comes with a free subdomain (keycloak.{dns_slug}.servorbit-dns.com) with an HTTPS certificate. You can also use a subdomain of one of your domains.",{"q":66,"a":67},"Where do I find the administrator password?","It is shown in your client area, on the page of the installed application; the username is admin. It opens the administration console of the master realm. Keycloak flags it as a temporary account: create your own administrator, then disable this one.",{"q":69,"a":70},"How much RAM should I plan for?","Keycloak runs on the JVM: expect about 600 MB at idle together with its PostgreSQL database. A 2 GB VPS is enough to start; move to 4 GB if several realms receive traffic or other applications share the server.",{"q":72,"a":73},"How do I back up and update Keycloak?","Accounts, realms, clients and persistent sessions live in the PostgreSQL database, stored in the keycloak-pgdata volume: back it up with pg_dump before every update. To upgrade, change the Keycloak image tag in the application's docker-compose.yml, then run docker compose pull and docker compose up -d; Keycloak migrates its schema on startup.",{"ram":75,"cpu":76,"disk":77,"stack":78,"port":81,"license":82,"version":83,"os":84},"2 GB minimum","2 vCPU","20 GB",[79,16,80],"Docker","PostgreSQL 17","8105","Apache-2.0","26.8.1","Ubuntu 24.04",[],[87,95,100],{"name":88,"slug":89,"categorySlug":13,"categoryName":90,"categoryColor":91,"logo":92,"tagline":93,"description":94},"Authentik","authentik","Cybersecurity & Bastion","text-red-400 bg-red-500\u002F10",null,"Self-hosted Auth0 alternative — full IdP with OIDC, SAML, LDAP, passkeys and a visual flow editor.","Open-source self-hosted identity platform: manage users, SSO, OIDC\u002FSAML, passkeys and custom authentication flows — an Auth0 and Okta alternative on your VPS.",{"name":96,"slug":97,"categorySlug":13,"categoryName":90,"categoryColor":91,"logo":92,"tagline":98,"description":99},"ZITADEL","zitadel","Manage identities, SSO and permissions self-hosted, ready in 5 minutes.","Open-source developer-first IAM platform: identity management, SSO OIDC\u002FOAuth 2.0, passkeys, and native multi-tenancy. A lightweight alternative to Keycloak for dev teams.",{"name":101,"slug":102,"categorySlug":13,"categoryName":90,"categoryColor":91,"logo":103,"tagline":104,"description":105},"Authelia","authelia","https:\u002F\u002Fcdn.simpleicons.org\u002Fauthelia","Add MFA, SSO and fine-grained access control in front of any app — no code changes required.","Open-source authentication and authorization gateway — add MFA, SSO and fine-grained access control in front of any app without touching its code.",[107,108,109],"keycloak-sso-vps","authentik-vs-authelia-keycloak-sso-vps-2026","deployer-zitadel-vps",{"key":111,"slug":13,"name":90,"objective":112,"icon":111,"color":91},"security","Harden infrastructure security.",1793289451024]