From b4227c5d0127d0e707ceeda893959ec048724686 Mon Sep 17 00:00:00 2001 From: pnzrp2 Date: Tue, 30 Jun 2026 09:37:32 -0600 Subject: [PATCH 1/3] new pages, remove blog posts, still WIP --- blog/2020-12-21-keycloak.md | 2 +- blog/2024-03-11-open-source-iam.md | 4 + blog/2024-05-01-alternatives-auth0.md | 119 ------ blog/2024-06-03-alternatives-okta.md | 84 ---- blog/2024-07-22-keycloak-vs-workos.md | 102 ----- blog/2024-07-31-keycloak-vs-onelogin.md | 106 ----- blog/2024-08-05-keycloak-vs-pingidentity.md | 109 ----- blog/2024-08-10-keycloak-vs-frontegg.md | 102 ----- ...24-10-18-keycloak-for-startups-overview.md | 2 +- ...-04-keycloak-for-startups-customization.md | 2 +- blog/2024-12-02-keycloak-for-startups-cost.md | 2 +- docusaurus.config.js | 101 ++++- package.json | 1 + pnpm-lock.yaml | 47 +++ src/components/CompareKeycloakBlock.jsx | 44 +++ .../comparison/ComparisonLayout.jsx | 233 +++++++++++ src/css/custom.css | 102 +++++ src/pages/hosting/self-host-vs-managed.jsx | 8 + src/pages/keycloak-alternatives.jsx | 373 ++++++++++++++++++ src/pages/keycloak-alternatives/auth0.jsx | 267 +++++++++++++ src/pages/keycloak-alternatives/frontegg.jsx | 324 +++++++++++++++ src/pages/keycloak-alternatives/okta.jsx | 284 +++++++++++++ src/pages/keycloak-alternatives/onelogin.jsx | 298 ++++++++++++++ .../keycloak-alternatives/ping-identity.jsx | 338 ++++++++++++++++ src/pages/keycloak-alternatives/workos.jsx | 331 ++++++++++++++++ .../open-source-vs-commercial-offering.jsx | 8 + src/pages/support/enterprise-support.jsx | 12 +- src/pages/support/migrate-to-keycloak.jsx | 12 +- 28 files changed, 2778 insertions(+), 639 deletions(-) delete mode 100644 blog/2024-05-01-alternatives-auth0.md delete mode 100644 blog/2024-06-03-alternatives-okta.md delete mode 100644 blog/2024-07-22-keycloak-vs-workos.md delete mode 100644 blog/2024-07-31-keycloak-vs-onelogin.md delete mode 100644 blog/2024-08-05-keycloak-vs-pingidentity.md delete mode 100644 blog/2024-08-10-keycloak-vs-frontegg.md create mode 100644 src/components/CompareKeycloakBlock.jsx create mode 100644 src/components/comparison/ComparisonLayout.jsx create mode 100644 src/pages/keycloak-alternatives.jsx create mode 100644 src/pages/keycloak-alternatives/auth0.jsx create mode 100644 src/pages/keycloak-alternatives/frontegg.jsx create mode 100644 src/pages/keycloak-alternatives/okta.jsx create mode 100644 src/pages/keycloak-alternatives/onelogin.jsx create mode 100644 src/pages/keycloak-alternatives/ping-identity.jsx create mode 100644 src/pages/keycloak-alternatives/workos.jsx diff --git a/blog/2020-12-21-keycloak.md b/blog/2020-12-21-keycloak.md index b62fe6c6..93757075 100644 --- a/blog/2020-12-21-keycloak.md +++ b/blog/2020-12-21-keycloak.md @@ -6,7 +6,7 @@ authors: phasetwo tags: [keycloak, phase_two, open_source] --- -Following the initial release of Phase Two's [authentication and SSO tools](https://phasetwo.io/docs/sso/) 3 months ago, we had a warm reception by several early- to mid- stage SaaS companies. The message was consistent. SSO was a key barrier to unlocking enterprise customers, and we had made it much easier to quickly integrate the alphabet-soup of enterprise identity providers, including [Auth0](https://phasetwo.io/blog/keycloak-vs-auth0-open-source-alternative/), [Okta](https://phasetwo.io/blog/keycloak-vs-okta-open-source-alternative/), and many others. +Following the initial release of Phase Two's [authentication and SSO tools](https://phasetwo.io/docs/sso/) 3 months ago, we had a warm reception by several early- to mid- stage SaaS companies. The message was consistent. SSO was a key barrier to unlocking enterprise customers, and we had made it much easier to quickly integrate the alphabet-soup of enterprise identity providers, including [Auth0](https://phasetwo.io/keycloak-alternatives/auth0/), [Okta](https://phasetwo.io/keycloak-alternatives/okta/), and many others. diff --git a/blog/2024-03-11-open-source-iam.md b/blog/2024-03-11-open-source-iam.md index d9c322a4..87a17059 100644 --- a/blog/2024-03-11-open-source-iam.md +++ b/blog/2024-03-11-open-source-iam.md @@ -64,3 +64,7 @@ Configuring, integrating, and operating an Identity and Access Management (IAM) ### Conclusion In a landscape dominated by commercial IAM solutions, Keycloak shines as a compelling alternative that combines the power of open source with enterprise-grade features and flexibility. With its cost-effectiveness, customization capabilities, deployment flexibility, and active community support, Keycloak empowers organizations to take control of their identity infrastructure, unlock new possibilities, and adapt to evolving security and compliance requirements. Whether you're a startup looking to bootstrap your identity management or an enterprise seeking to streamline operations, Keycloak offers a compelling solution that puts you in the driver's seat of your IAM journey. + +## Compare Keycloak to specific platforms + +For a side-by-side breakdown against individual vendors, see the [Keycloak alternatives hub](https://phasetwo.io/keycloak-alternatives/) or a detailed comparison: [Auth0](https://phasetwo.io/keycloak-alternatives/auth0/), [Okta](https://phasetwo.io/keycloak-alternatives/okta/), [WorkOS](https://phasetwo.io/keycloak-alternatives/workos/), [Ping Identity](https://phasetwo.io/keycloak-alternatives/ping-identity/), [FrontEgg](https://phasetwo.io/keycloak-alternatives/frontegg/), [OneLogin](https://phasetwo.io/keycloak-alternatives/onelogin/). diff --git a/blog/2024-05-01-alternatives-auth0.md b/blog/2024-05-01-alternatives-auth0.md deleted file mode 100644 index 0f3a5658..00000000 --- a/blog/2024-05-01-alternatives-auth0.md +++ /dev/null @@ -1,119 +0,0 @@ ---- -title: "Keycloak vs. Auth0: The Open-Source Alternative (2026 Guide)" -description: A 2026 comparison of Keycloak vs. Auth0 — cost, deployment, maintenance, and features — and why managed Keycloak is a strong open-source alternative to Auth0. -slug: keycloak-vs-auth0-open-source-alternative -date: 2024-05-01 -authors: phasetwo -tags: [phase_two, open_source, authentication, authorization, auth0, keycloak] ---- - -## Keycloak vs. Auth0: Choosing an Open-Source Alternative for Authentication - -*Last updated: 2026 — pricing and feature comparisons reflect Auth0's current published plans.* - -When it comes to implementing authentication and authorization in web applications, Auth0 and Keycloak are two prominent solutions that offer robust security features. Auth0 is a popular, fully managed cloud platform; Keycloak is an open-source alternative that competes strongly on cost, control, and flexibility. This post compares the two across cost of ownership, architecture and deployment, maintenance, functionality, and support — and explains why pairing Keycloak with a managed host like Phase Two often gives you the best of both. - - - -A quick note before we start: much of the older commentary about Keycloak's limitations is out of date. Many critiques still circulating online cite G2 reviews that are four-plus years old — more than ten major [Keycloak versions](https://github.com/keycloak/keycloak/releases) behind the current release. When researching Keycloak, check which version is being discussed. We keep the information below aligned with recent Keycloak versions. - -If you're weighing other vendors too, we maintain open-source-alternative comparisons for [Okta](https://phasetwo.io/blog/keycloak-vs-okta-open-source-alternative/), [WorkOS](https://phasetwo.io/blog/keycloak-vs-workos-open-source-alternative/), [Ping Identity](https://phasetwo.io/blog/keycloak-vs-PingIdentity-open-source-alternative/), [FrontEgg](https://phasetwo.io/blog/keycloak-vs-frontegg-open-source-alternative/), and [OneLogin](https://phasetwo.io/blog/keycloak-vs-onelogin-open-source-alternative/) — and a broader overview of [Keycloak as an open-source alternative to Auth0, WorkOS, Okta, and Cognito](https://phasetwo.io/blog/open-source-iam/). - -## Keycloak vs. Auth0 at a Glance - -| Dimension | Auth0 | Keycloak (with Phase Two) | -|---|---|---| -| **Licensing model** | Proprietary, subscription | Open source (Apache 2.0), no license fee | -| **Pricing driver** | Per monthly active user (MAU) + features | Fixed infrastructure / hosting cost, not per-user | -| **Cost predictability** | Scales with users and features | Predictable; decoupled from user growth | -| **Deployment** | Cloud SaaS only | Self-hosted, your cloud, on-premise, or managed | -| **Data residency / sovereignty** | Limited control | Full control over environment and data location | -| **Maintenance** | Fully managed by Auth0 | Managed by you, or by Phase Two if hosted | -| **Standards** | OAuth 2.0, OIDC, SAML | OAuth 2.0, OIDC, SAML | -| **Extensibility** | Actions framework (bounded) | Full source access + SPIs/extensions | -| **Vendor lock-in** | High | Low — portable, standards-based | -| **Best fit** | Teams wanting zero-ops and paying per user | Teams wanting control, predictable cost, or on-prem | - -## Cost of Ownership - -Total cost of ownership has many factors. We've written extensively about [choosing an open-source IAM](https://phasetwo.io/blog/open-source-iam/) over a managed proprietary service. - -**Auth0:** Auth0 operates on a subscription model that can be appealing for startups or small projects with minimal authentication needs. Its free tier is generous on paper — up to 25,000 monthly active users (MAU) — but it's bounded on connections, organizations, and features, and most production workloads quickly outgrow it. - -Here's the catch: Auth0's list prices look modest until you map them to how a real application actually uses the platform. As of 2026, Auth0's published pricing (per month, billed monthly) scales like this: - -| Monthly active users | B2C Essentials | B2C Professional | B2B Essentials | -|---|---|---|---| -| 1,000 | $70 | $240 | $300 | -| 5,000 | $350 | $1,000 | $1,300 | -| 10,000 | $700 | $1,600 | $2,100 | -| 20,000 | $1,400 | $3,200 | $3,800 | - -*Figures reflect Auth0's published list pricing as of 2026 ([auth0.com/pricing](https://auth0.com/pricing)); Auth0 changes pricing periodically, so confirm current rates for your tier and region.* - -Two things push the real bill well beyond the headline numbers: - -1. **The features you actually need live in higher tiers and add-ons.** SAML, LDAP/Active Directory federation, log streaming, and similar capabilities move you up a band — and several common needs are billed as separate line items on top of your subscription. Additional enterprise SSO connections run about $100/month *each* on B2B plans; MFA is a $100/month add-on on B2B Essentials; machine-to-machine (M2M) tokens are metered separately (up to roughly $1,200/month for 300,000 tokens); and the newer AI Agents add-on is priced at 50% of your base subscription. Every capability you switch on either bumps your tier or tacks on a charge. - -2. **"Users" and "organizations" aren't cheap.** If you sell to businesses, Auth0's B2B model is the one that fits — and it costs materially more than B2C at the same scale (for example, **$3,800/month for B2B Essentials vs. $1,400/month for B2C Essentials at 20,000 MAU**). Note also that "users" can mean people *or* devices, and organizations, enterprise connections, and per-customer SSO all push the number up. - -For anything beyond mid-size, Auth0 routes you into a custom Enterprise contract. In practice those negotiations tend to land in the six figures annually — we routinely talk to teams whose Auth0 quotes target **$100K+ per year** once SSO, MFA, organizations, and log streaming are bundled in. The problem isn't that any single number is outrageous; it's that the total is hard to predict and climbs with every feature and every user you add. - -**Keycloak:** Keycloak is an open-source solution originally developed and backed by Red Hat. It is free to use regardless of the number of users or scale of the project, which makes it attractive for teams looking to control costs or avoid vendor-specific pricing. The primary cost is hosting and operating the software — server costs plus setup and maintenance overhead — which means your spend tends to be **fixed**, driven by infrastructure rather than by user counts or feature gates. - -**Winner: Keycloak.** Phase Two's [managed hosting](https://phasetwo.io/hosting/) offers a capable free tier to test and integrate authentication, and as your application's needs grow, Keycloak remains far more cost-effective. See a side-by-side [pricing estimate vs. Auth0](https://phasetwo.io/pricing/hosting/). - -## Architecture and Deployment - -**Auth0:** Auth0 is a cloud-based service, so there's little infrastructure to set up or configure. That enables quick deployment and removes much of the DevOps burden. The trade-off: enterprises with strict regulatory or data-residency requirements often need on-premise options that a SaaS-only model can't provide. - -**Keycloak:** Keycloak can be deployed on-premise, in your own cloud, or via a [managed cloud service](https://phasetwo.io/hosting/). Because you control the deployment environment, it conforms to compliance and data-sovereignty needs. Initial infrastructure setup can take more effort, but the result is a flexible, standards-based system that integrates cleanly with your applications. - -**Winner: Depends.** If you need on-premise or strict data control, Keycloak wins clearly. For a purely hosted option, either can work — and Keycloak still gives you the flexibility to [self-host or use managed hosting](https://phasetwo.io/hosting/self-host-vs-managed/). - -## Maintenance - -**Auth0:** As a managed service, Auth0 requires minimal maintenance from your side. Auth0 handles updates, security patches, and infrastructure, keeping the system current. - -**Keycloak:** Self-hosted Keycloak requires more attention — installation, configuration, upgrades, and the underlying infrastructure. For teams without that expertise or capacity, this is a real consideration. The upside is greater control over deployment and security posture, which matters in regulated environments. Phase Two removes this trade-off entirely: with [managed hosting](https://phasetwo.io/hosting/) and [zero-downtime upgrades](https://phasetwo.io/support/zero-downtime-upgrades/), you get Keycloak's control without the operational load. - -**Winner: Auth0 (for self-hosted Keycloak); a tie when Keycloak is managed by Phase Two.** - -## Functionality and Flexibility - -**Auth0:** Auth0 offers a broad set of authentication features out of the box — social logins, enterprise federation, database connections, and more — and supports OAuth 2.0, OpenID Connect, and SAML. It also provides analytics and monitoring. Customization happens through its Actions framework, which can become difficult to manage as logic grows outside the main application. - -**Keycloak:** Keycloak matches Auth0 on core functionality, supporting the same protocols and user federation, with customizable login, registration, and account-management UIs. Being open source, it lets developers extend the codebase and integrate with other systems far more freely — a higher ceiling for customization in exchange for some additional developer effort. A standout capability is Keycloak's [on-premise deployment](https://phasetwo.io/product/onprem/) options; if your requirements include on-prem, learn how Keycloak handles [user management and identity brokering for on-premise apps](https://phasetwo.io/blog/identity-brokering-on-prem/). - -**Winner: Keycloak.** The two are comparable on features, but Keycloak is far more extensible and configurable, and can grow with your application. - -## Migrating from Auth0 to Keycloak - -Moving off Auth0 is more approachable than many teams expect. Keycloak imports users, supports gradual cutover, and brokers identities so you can transition without disrupting access. We've built tooling and a process specifically for this — see [Migrate to Keycloak](https://phasetwo.io/support/migrate-to-keycloak/) for how we move teams off Auth0, Okta, and Cognito. - -You can also run Keycloak *alongside* Auth0 during a transition: Keycloak can act as a broker that delegates authentication to an external IdP such as Auth0. That lets you keep existing Auth0 connections while Keycloak handles internal permissions, roles, and a consistent login experience — a low-risk path to migrating one piece at a time. - -## Which One Is Best for Me? - -Choosing between Auth0 and Keycloak depends on your organization's needs and capabilities. Auth0 is an excellent fit for teams that want a fully managed solution and are comfortable with costs tied to user counts and features. For teams that prioritize cost predictability, need infrastructure control or on-premise deployment, or want extensive customization, Keycloak is a powerful, budget-friendly alternative. Both offer strong documentation and community support. - -Ultimately, we believe the strongest setup marries the two ideas: **Keycloak's openness and flexibility with the convenience of a managed service.** Phase Two offers [hosting options](https://phasetwo.io/hosting/) that fit businesses of many sizes, so you get Keycloak's control and fixed, predictable costs without taking on the operational burden yourself. - -Ready to compare for your own usage? [Estimate your cost vs. Auth0](https://phasetwo.io/pricing/hosting/) or [try a free deployment](https://dash.phasetwo.io/). - -## Frequently Asked Questions - -**Is Keycloak a good alternative to Auth0?** -Yes. Keycloak supports the same core standards as Auth0 (OAuth 2.0, OpenID Connect, SAML) and matches it on most authentication and authorization features, while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes. - -**Is Keycloak cheaper than Auth0?** -For most growing applications, yes. Auth0 pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows. Teams moving from Auth0 to managed Keycloak frequently see substantial savings. - -**Can I migrate from Auth0 to Keycloak?** -Yes. Keycloak can import your users and broker authentication to Auth0 during a phased cutover, so you can migrate incrementally without disrupting users. See [Migrate to Keycloak](https://phasetwo.io/support/migrate-to-keycloak/). - -**Does Keycloak support SAML, OIDC, and OAuth 2.0?** -Yes. Keycloak is built on these standards and interoperates with both modern applications and legacy systems, including LDAP and Active Directory. - -**Can Keycloak be self-hosted or run on-premise?** -Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over Auth0's cloud-only model, especially for data-residency and compliance requirements. diff --git a/blog/2024-06-03-alternatives-okta.md b/blog/2024-06-03-alternatives-okta.md deleted file mode 100644 index 54a89499..00000000 --- a/blog/2024-06-03-alternatives-okta.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: "Keycloak vs. Okta, a Open-Source Alternative" -description: An in-depth comparison of Keycloak versus Okta and why Keycloak offers a strong and compelling alternative to a paid Authentication and Authorization service. -slug: keycloak-vs-okta-open-source-alternative -date: 2024-06-03 -authors: phasetwo -tags: [phase_two, open_source, authentication, authorization, okta, keycloak] ---- - -## Exploring Keycloak as an Alternative to Okta for Authentication Solutions - -In today's rapidly evolving digital landscape, securing and managing user identities has become more critical than ever. Organizations are faced with the challenge of choosing the right Identity and Access Management (IAM) solution that balances cost, ease of implementation, and robust feature sets. Two popular contenders in this space are Keycloak and Okta. Keycloak, an open-source solution developed by Red Hat, offers extensive customizability and a community-driven support model. On the other hand, Okta, a leading cloud-based IAM provider, promises quick deployment and comprehensive security features through its subscription-based service. In this blog post, we will delve into a detailed comparison of Keycloak and Okta, examining their costs, total cost of ownership, implementation processes, and the rich array of features and capabilities each brings to the table. Whether you're a small startup or a large enterprise, understanding these key differences will help you make an informed decision for your identity management needs. - - - -We've compared [Keycloak to Auth0](./2024-05-01-alternatives-auth0.md) and it's worth noting that Auth0 is owned by Okta. The differences between the offerings are subtle, where Auth0 bills it more as the "developer" tool while Okta is for "SSO". They are separate subscriptions. - -### Cost of Ownership - -When evaluating Identity and Access Management (IAM) solutions, both upfront cost and total cost of ownership (TCO) are critical considerations. There are many factors to think about with a total cost-of-ownership. We've written extensively about [choosing an Open-Source IAM](./2024-03-11-open-source-iam.md) over a managed service. - -#### Okta: - -Okta operates on a subscription-based pricing model, with costs varying based on the number of users and selected features. This SaaS solution tries to simplify cost management by bundling infrastructure, maintenance, and support into its subscription fees. Organizations benefit from reduced internal IT burden, as Okta handles updates, patches, and system maintenance. However, the per-user costs can add up, especially for larger organizations, potentially leading to higher ongoing expenses compared to an open-source alternative like Keycloak. While Okta provides scalability, allowing businesses to grow without worrying about infrastructure investments, the costs that are incurred can quickly balloon far out of the original projections. With every feature enabled, the per user cost grows significantly and bills can rapidly sky-rocket in multi $100K+, becoming a large financial piece of the overall IT spend. - -#### Keycloak: - -Keycloak, on the other hand, is an open-source solution developed by Red Hat. It is free to use, regardless of the number of users or the scale of the project. This makes Keycloak particularly attractive for businesses looking to cut costs or those who prefer not to be tied to vendor-specific pricing structures. - -Keycloak, being an open-source solution, stands out with its zero licensing fees, regardless of the number of users or the scale of the project. This makes it an attractive option for organizations looking to minimize expenditures. However, it's important to note that while Keycloak is free to use, it does require infrastructure to [host](https://phasetwo.io/hosting/) and run the application. This could involve costs related to cloud services or on-premises hardware. Additionally, maintaining and updating Keycloak, as well as implementing customizations, may necessitate dedicated internal resources or external support, which can add to the overall expenses. The primary cost associated with Keycloak comes from the need to self-host and manage the software, which includes server costs and potential overhead for setup and maintenance. This can mean the ongoing cost is fixed since its not driven by features or users. - -**Winner** - -Keycloak - -Leveraging Phase Two's [managed hosting](https://phasetwo.io/hosting/) provides a more capable free tier to test out and integrate Authorization and Authentication into an application(s). When that application's needs grow for users and integrations, Keycloak quickly becomes a far more cost-effective choice. - -### Maintenance - -#### Okta: - -A strong advantage of Okta is that it is a managed service. From a Dev Ops perspective, it requires minimal maintenance. The Okta team handles updates, security patches, and infrastructure, ensuring that the system is kept up-to-date. This comes at a cost though since customization of Okta is limited. - -#### Keycloak: - -Conversely, Keycloak requires more attention since it's self-hosted. Organizations must allocate resources for installing, configuring, and updating the software, as well as managing the underlying infrastructure. This can be a drawback for teams without the necessary technical expertise or resources. However, it also offers greater control over the deployment and security standards, which can be a significant advantage for certain regulatory environments. - -**Winner** - -Okta. - -As a fully managed service, Okta abstracts away this work. - -### Functionality and Flexibility - -#### Okta: - -Okta’s authentication mechanisms support multiple methods for enhanced security and user convenience. The platform’s authorization capabilities include role-based access control (RBAC) and policy management, allowing organizations to enforce detailed security policies. Okta supports identity federation through SAML, OpenID Connect, and other standards, facilitating integration with various identity providers. Its single sign-on (SSO) functionality ensures a seamless user experience across different applications and services. Okta’s user management features are extensive, offering self-service registration, account recovery, and a comprehensive user directory. Additionally, Okta’s APIs and pre-built integrations with numerous third-party applications simplify the implementation process. The platform also provides detailed analytics, logging, and reporting features for monitoring and compliance, as well as automated user provisioning, deprovisioning, and workflow management through its lifecycle management capabilities. - -#### Keycloak: - -Keycloak offers a comprehensive suite of features designed to meet the needs of modern applications that are at parity (or better) in many ways with Okta. Keycloak provides various authentication methods, including username/password, social logins, and multi-factor authentication (MFA), ensuring secure access for users. It also supports fine-grained authorization capabilities through role-based access control ([RBAC](https://phasetwo.io/product/organizations/)) and attribute-based access control ([ABAC](https://phasetwo.io/product/organizations/)), enabling precise management of user permissions. Keycloak excels in identity federation, supporting protocols like SAML and OpenID Connect, which allows seamless integration with other identity providers. Additionally, Keycloak’s single sign-on ([SSO](https://phasetwo.io/product/sso/)) feature facilitates a smooth user experience across multiple applications, while its extensive [user management](https://phasetwo.io/product/adminportal/) capabilities, including user registration, password policies, and account linking, ensure comprehensive control over user identities. The platform is highly customizable, offering themes, custom code, and extensive configuration options, and benefits from strong community support and a wide range of extensions and plugins. - -A main point is that the features that Okta and Auth0 try to cover (somewhat separately) are all covered by why Keycloak can do. - -**Winner** - -Keycloak - -Okta and Keycloak offer much of the same functionality for Authentication and Authorization, however Keycloak is extremely flexible to extend and configure. It's a system that can adjust and grow with an application. In addition, there is no distinction in capabilities between different products, meaning Keycloak centralizes more use-cases. - -### Integrating Keycloak with External Systems like Okta - -For organizations looking to transition from Okta to Keycloak or integrate Keycloak with systems that are already using Okta, Keycloak's flexibility offers significant advantages. Keycloak can be configured to act as a broker that sits between Okta and your applications. This setup allows organizations to leverage the strengths of both platforms. For example, an organization can use Okta for external user management due to its robust third-party integrations while using Keycloak to handle more sensitive internal authentication needs. - -The identity brokering capability of Keycloak enables it to delegate authentication to external Identity Providers (IdPs), such as Okta. This means that Keycloak can manage internal permissions and roles, provide additional security checks, and maintain a user-friendly, consistent login experience across different systems. The ability to integrate seamlessly with services like Okta simplifies the migration process for companies transitioning from one authentication system to another and provides a layer of flexibility for new authentication strategies without disrupting user access or security. - -### Which IAM Solution Is Best for Me? - -Choosing between Okta and Keycloak largely depends on your organization’s specific needs and capabilities. Okta is an excellent choice for those who need a fully managed solution with costs linked to user numbers and features. However, for organizations that prioritize cost savings and predictability, have the capability to manage their infrastructure, or require extensive customization, Keycloak emerges as a powerful, budget-friendly alternative. - -Both platforms offer extensive documentation and community support, which can help mitigate some of the challenges associated with implementation and maintenance. - -Ultimately, we at Phase Two believe marrying the two together is the strongest match. We offer robust Keyloak [hosting](https://phasetwo.io/hosting/), migration, and support options that fit well for multiple business sizes. Coupling the capabilities of Keycloak and the advantages of a managed service translates directly to implementation and cost control in SSO, authenication, authorization, user management, and other areas. **Leveraging Keycloak means that ongoing costs are relatively fixed**, since concerns about user growth or feature needs don't have to factor into every decision. diff --git a/blog/2024-07-22-keycloak-vs-workos.md b/blog/2024-07-22-keycloak-vs-workos.md deleted file mode 100644 index 35aeff03..00000000 --- a/blog/2024-07-22-keycloak-vs-workos.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Keycloak vs. WorkOS, an Open-Source Alternative -description: An in-depth comparison of Keycloak versus WorkOS and why Keycloak is a strong alternative to a paid Authentication and Authorization service. -slug: keycloak-vs-workos-open-source-alternative -authors: phasetwo -tags: [phase_two, open_source, authentication, authorization, workos, keycloak] ---- - -Exploring Keycloak as an Alternative to WorkOS for Authentication Solutions - -Keycloak and WorkOS are both identity and access management (IAM) solutions that offer various features for authentication, authorization, and user management. While they serve similar purposes, there are key differences between the two platforms that make them unique and suitable for different use cases. Keycloak is an open source platform under active development for over 8 years and known for its scalability and customization options. WorkOS is a closed-source platform that can quickly integrate SSO to an application. In this blog post, we'll explore the key differences between Keycloak and WorkOS, focusing on factors such as cost of ownership, scalability, deployments, and maintenance. - - - -### Cost of Ownership - -**Keycloak:** -Keycloak is an open-source solution and is available for free, making it a cost-effective choice for startups, small businesses, and enterprises alike. It allows organizations to save on licensing fees and scale without worrying about escalating SSO, authentication, and other costs. It does, however, require infrastructure to host and run the application, which can run up costs if a business does not have the proper internal resources or external support. This provides a more predictable cost model when bringing together multiple applications, knowing that as additional connections are created, costs will not increase. The biggest factor in cost becomes the scale of needed infrastructure. - -**WorkOS:** -WorkOS operates on a subscription-based model, where pricing is tied to the number of monthly active users. While the first million users are included (at time of publishing), WorkOs charges for Custom domains, SSO connections, SCIM, and Audit logs. The more enterprise customers you have, the more your costs will grow. This approach allows customers to scale their identity management solution as needed, while also gaining access to additional features and support based on their chosen plan. Organizations must keep in mind that with every feature enabled, the per user cost grows significantly and bills can rapidly sky-rocket, becoming a large financial piece of the overall IT spend. - -**Winner** - -With the proper hosting solution, Keycloak is a far more cost-effective choice. Since cost isn't driven by features or users, the ongoing cost is fixed, enabling organizations to allocate funds to other resources. Leverage [Phase Two's Free Hosting Tier](https://phasetwo.io/hosting/) to test and integrate Authorization and Authentication into an application(s). - -### Deployment and Maintenance - -**Keycloak:** -Keycloak is a solution that can be deployed on-premises or in a private cloud. It provides complete control over the infrastructure and allows customization and integration with existing systems. With support for Docker, Kubernetes, and other containerization technologies, Keycloak simplifies deployment across various environments, ensuring seamless integration into existing infrastructure and workflows. - -Due to Keycloak’s self-hosted nature, however, organizations must allocate resources for installing, configuring, and updating the software, as well as managing the underlying infrastructure. - -**WorkOS:** -WorkOS is a cloud-based identity platform that is hosted and managed by WorkOS. It offers a simpler deployment process as there is no need to set up or maintain any infrastructure. -Organizations benefit from reduced internal IT burden, as WorkOS handles updates, security patches, and system maintenance. - -**Winner** - -WorkOS provides a more hassle-free identity management experience by offloading infrastructure responsibilities through a fully managed service. - -### Customization and Branding - -**Keycloak:** -Keycloak offers unparalleled customization and extensibility -- from authentication flows and user federation to role-based access control (RBAC) and fine-grained permission -- enabling organizations to tailor the user experience, login screens, and authentication process to their specific needs. This level of customization requires working in and gaining knowledge of the capabilities of Keycloak. - -**WorkOS:** -WorkOS on the other hand, offers limited customization options and focuses more on providing a unified user experience across different identity providers. We certainly tip our hats to WorkOS for the fantastic job they’ve done at creating a wonderful user experience from a design and user experience perspective. - -**Winner** - -Keycloak by a nose. Keycloak offers complete control over the look and feel of the authentication and authorization process. However, WorkOS has done a strong job at simplifying and constraining the world for quick implementation. - -### Scalability and Performance - -**Keycloak:** -With its robust architecture, Keycloak is designed to handle large-scale user bases, making it an ideal choice for enterprises. It can be easily scaled horizontally by adding more instances or running in a clustered mode, ensuring high performance and reliability. Keycloak offers a great platform to unify on for companies that find themselves with a burgeoning number of applications that have each gone their own way of IAM implementation. - -**WorkOS:** -While WorkOS offers scalable infrastructure, it's better suited for smaller to medium-sized applications with moderate to high traffic volumes. Its architecture is optimized for efficient performance, but may not be as well-equipped to handle extremely high volumes of user traffic or a ballooning of connected enterprises. It’s better at working with a specific application rather than connecting multiple applications. - -**Winner** - -Depends. Keycloak is a strong contender for large-scale applications looking to scale, but WorkOS may deliver stronger performance for small-mediums sized apps. - -### Functionality and Flexibility - -**Keycloak:** -Keycloak offers a comprehensive suite of features to meet the needs of modern apps. It provides secure authentication methods, including username/password, social logins, and MFA, as well as fine-grained authorization controls through RBAC and ABAC. Keycloak excels in identity federation with support for SAML and OpenID Connect, and its SSO feature offers a seamless user experience across apps. It also offers robust user management capabilities, customization options, self-registration, and active community support. For any functionality that might be missing, extensions to Keycloak can be written and deployed. This allows for Keycloak to bend and mold to the needs of its developers. - -**WorkOS:** -WorkOS offers robust authentication and authorization capabilities, including role-based access control, policy management, and support for multiple identity standards. Its single sign-on feature provides a seamless user experience across apps and services. WorkOS also features self-service registration, account recovery, and a comprehensive user directory. Integration with third-party apps is simplified through APIs and pre-built integrations, while analytics and logging tools help with monitoring and compliance. - -**Winner** - -Both WorkOS and Keycloak offer robust functionality, but Keycloak's advanced identity federation capabilities, fine-grained authorization controls, and ability to customize and extend give it an edge over WorkOS. - -### Integration Capabilities - -**Keycloak:** -The identity brokering capability of Keycloak enables delegation authentication to external Identity Providers (IdPs), applications, and protocols such as LDAP, SAML, OAuth, OpenID Connect. Managing internal permissions and roles, security checks, login experiences across different systems can be done seamlessly. - -If you’re switching from WorkOS, for example, Keycloak can be configured to act as a broker that sits between WorkOS and your applications to leverage the strengths of both platforms. For example, WorkOS can be used for external user management, while Keycloak can handle more sensitive, internal authentication needs. - -**WorkOS:** -There is a narrower focus on authentication, but WorkOS provides a uniform API to integrate with popular identity providers like Google, Microsoft, and Okta. The unified interface reduces the complexity and development time. - -**Winner** - -Keycloak is the most versatile choice for organizations with complex requirements. - -### Community and Support - -[Keycloak](https://github.com/keycloak) has a large and active community of developers and contributors, ensuring continuous development, bug fixes, and updates. It has extensive documentation, forums, and [community support channels](https://keycloak.discourse.group/) where users can seek help and share knowledge. WorkOS also provides support but may have limitations in terms of community contributions and public resources. It offers dedicated support channels and resources to its users for assistance and issue resolution. - -### Which One Is Best for Me? - -In determining the most suitable identity and access management solution for your organization, it is essential to consider the specific requirements and priorities of your enterprise. In summary, Keycloak is an open-source identity and access management solution that offers extensive customization and integration capabilities, making it suitable for organizations with complex requirements. WorkOS, on the other hand, is a cloud-based identity platform that simplifies integration and deployment but may have limitations in terms of scalability and customization options. - -Working with Phase Two provides some of the best of both worlds: easy integration with ability to scale without incurring additional costs. - -If you’re looking to [migrate to Keycloak](https://phasetwo.io/support/migrate-to-keycloak/), or have questions about Phase Two’s [enterprise support](https://phasetwo.io/support/), please [contact us](https://scheduler.zoom.us/phasetwo). diff --git a/blog/2024-07-31-keycloak-vs-onelogin.md b/blog/2024-07-31-keycloak-vs-onelogin.md deleted file mode 100644 index d5ef7342..00000000 --- a/blog/2024-07-31-keycloak-vs-onelogin.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Keycloak vs. OneLogin, an Open-Source Alternative -description: An in-depth comparison of Keycloak versus OneLogin and why Keycloak is a strong alternative to a paid Authentication and Authorization service. -slug: keycloak-vs-onelogin-open-source-alternative -authors: phasetwo -tags: - [phase_two, open_source, authentication, authorization, onelogin, keycloak] ---- - -Exploring Keycloak as an alternative to OneLogin for Authentication Solutions - -Keycloak and [OneLogin](https://www.onelogin.com) (by One Identity) are both important players in the identity and access management (IAM) space, each catering to different organizational needs. Keycloak is an open-source solution with over eight years of active development, known for its scalability and customization. OneLogin, on the other hand, is a commercial product emphasizing user-friendly interfaces and extensive integration options. This article compares Keycloak and OneLogin based on cost, deployment, customization, scalability, functionality, integration, and support. - - - -### Cost Structure - -**Keycloak:** -As an open-source platform, Keycloak is free to use, making it a cost-effective option for businesses of all sizes. While there are no licensing fees, users must be prepared to manage their own hosting and infrastructure, which can incur costs depending on resource needs. - -**OneLogin:** -OneLogin operates on a subscription model, with pricing starting at $2 per month per user for its basic services. Advanced features, such as multi-factor authentication (MFA), require higher-tier licenses, which can lead to increased costs, particularly for large enterprises with many users requiring advanced security features. Further pricing is opaque and requires engaging OneLogin sales. - -**Winner** - -Keycloak is more economically advantageous and transparent, particularly for organizations equipped to manage their own hosting. Leverage Phase Two's [Free Hosting](https://phasetwo.io/hosting/) Tier to test and integrate Authorization and Authentication into an application(s). - -### Deployment and Maintenance - -**Keycloak:** -Keycloak supports on-premises and private cloud deployments. Organizations have full control over configurations, but they must also bear the responsibility of maintenance and updates. - -**OneLogin:** -OneLogin is primarily a cloud-based solution but also provides on-premises options. It is managed by the vendor, meaning organizations benefit from automatic updates and less internal maintenance. - -**Winner** - -OneLogin simplifies deployment and reduces maintenance tasks for IT teams. - -### Customization and Branding - -**Keycloak:** -Keycloak allows extensive customization, enabling organizations to tailor authentication workflows and user interfaces according to specific needs. When unifying login from multiple systems to a single one, that means Keycloak and adapt and support as necessary. However, this level of customization may require more technical expertise. - -**OneLogin:** -While OneLogin offers a customizable interface, its options are more limited compared to Keycloak. It focuses on providing a unified experience without deep customization. Specific business use-cases may not be supported. - -**Winner** - -Keycloak wins in customization and flexibility; OneLogin provides some simplicity without the ability to adapt to specific needs. - -### Scalability and Performance - -**Keycloak:** -Keycloak is designed to scale efficiently, accommodating large user bases through horizontal scaling and clustered deployments, making it suitable for extensive enterprise environments. - -**OneLogin:** -As a cloud solution, OneLogin is also scalable, but is typically geared towards medium-sized enterprises. It can handle multiple applications but may not perform optimally under very high user loads. - -**Winner** - -Both will likely be able to scale, but Keycloak is the better choice for large-scale applications requiring high concurrency and user sessions. - -### Functionality and Flexibility - -**Keycloak:** -Keycloak provides a comprehensive suite of features, including diverse authentication methods, fine-grained access control, and strong identity federation capabilities (OpenID Connect, OAuth 2.0, SAML 2.0). It allows for deeper integration with existing systems. - -**OneLogin:** -OneLogin is built using Ruby on Rails and includes essential features such as SSO and MFA, using artificial intelligence to assess user risk scores, enhancing security functionality. However, it may not match Keycloak in offering a wide array of advanced features for complex IAM scenarios. - -**Winner** - -Keycloak holds an advantage with its broader range of functionalities and flexibility of integration. - -### Integration Capabilities - -**Keycloak:** -Keycloak supports integration with various Identity Providers and protocols, enabling flexible authentication across systems. It also has built-in support for many Social Identity Providers, like Google, Twitter, Facebook, Stack Overflow. These can be configured in an advanced manner. - -**OneLogin:** -OneLogin features a well-developed library of pre-built integrations for third-party applications, providing a straightforward way to manage user access across different systems. It also integrates with HR systems and supports directory integrations, which can be particularly useful for SMEs relying on a variety of SaaS applications. - -**Winner** - -The choice depends on specific needs; OneLogin is easier for basic integrations, while Keycloak offers greater versatility for complex requirements. - -### Community and Support - -**Keycloak:** -[Keycloak](https://github.com/keycloak) has a supportive open-source community, with extensive documentation and user forums for troubleshooting and guidance. Phase Two offers [enterprise support](https://phasetwo.io/support/) for hosted and on-prem customers, or those with their own Keycloak deployment. - -**OneLogin:** -OneLogin provides dedicated customer support, along with comprehensive documentation and professional services for additional assistance. - -**Winner** - -Keycloak’s community offers robust support for users, while OneLogin provides more direct, vendor-driven help. - -### Which one is best for me? - -When selecting an IAM solution, it’s essential to evaluate your organization’s specific needs. Keycloak is ideal for those seeking an open-source, highly customizable platform that can scale to meet complex requirements. In contrast, OneLogin is well-suited for enterprises looking for an easy-to-use, managed service with a focus on integrations. As one’s implementation grows in size, the cost may become too high to entertain. - -Working with Phase Two provides some of the best of both worlds: easy integration with ability to scale without incurring additional costs. - -If you’re looking to [migrate to Keycloak](https://phasetwo.io/support/migrate-to-keycloak/), or have questions about Phase Two’s [enterprise support](https://phasetwo.io/support/), please [contact us](https://scheduler.zoom.us/phasetwo). diff --git a/blog/2024-08-05-keycloak-vs-pingidentity.md b/blog/2024-08-05-keycloak-vs-pingidentity.md deleted file mode 100644 index 836d8ab4..00000000 --- a/blog/2024-08-05-keycloak-vs-pingidentity.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: Keycloak vs. PingIdentity, an Open-Source Alternative -description: An in-depth comparison of Keycloak versus PingIdentity and why Keycloak is a strong alternative to a paid Authentication and Authorization service. -slug: keycloak-vs-PingIdentity-open-source-alternative -authors: phasetwo -tags: - [ - phase_two, - open_source, - authentication, - authorization, - pingidentity, - keycloak, - ] ---- - -Exploring Keycloak as an alternative to PingIdentity for Authentication Solutions - -In the evolving landscape of identity and access management (IAM), organizations face critical decisions regarding the tools that will best meet their needs. Keycloak and [Ping Identity](https://www.pingidentity.com/) are two noteworthy solutions, each exhibiting unique features that cater to different organizational requirements. This blog provides a detailed comparison of open-source Keycloak and the commercial offering of Ping Identity across essential aspects of IAM solutions. - - - -### Deployment Model - -**Keycloak:** -Keycloak is an open-source IAM solution that can be deployed both [on-prem](https://phasetwo.io/product/onprem/) and in cloud environments. This flexibility allows organizations to choose their preferred hosting option while maintaining control over their identity management infrastructure. Its ability to adapt quickly to new standards makes it particularly suitable for agile development environments. - -**PingIdentity:** -Ping Identity offers a hybrid deployment model that combines both cloud-based and on-premises options. This versatility is particularly beneficial for large enterprises where regulatory compliance dictates specific control over identity services. - -**Winner** - -Tie. Both solutions offer strong options for those seeking to deploy the way they want to and need to. Both provide enterprise-centric hybrid options that accommodate complex infrastructure needs. - -### Customization and Flexibility - -**Keycloak:** -Keycloak shines with its extensive customization features, allowing developers to modify everything from login pages to role-based access controls. Being open-source software, organizations have the freedom to make adjustments at any time without vendor lock-in, making it a powerful and cost-effective solution. It can be used as a standalone solution or integrated as an element of a broader IT infrastructure. - -**PingIdentity:** -Ping Identity also offers customization capabilities but often demands more technical effort to implement tailored solutions. While it is configurable, achieving significant customizations may be more challenging compared to Keycloak. - -**Winner** - -Keycloak wins for its superior flexibility and ease of customization, particularly appealing to developers. - -### User Experience and Ease of Use - -**Keycloak:** -Keycloak is designed with usability in mind, featuring an intuitive interface and straightforward setup process. Its fast, agile nature allows it to adapt quickly to changing application landscapes, ensuring accessibility for users. It supports Single Sign-On (SSO), identity brokering, and various protocols (OAuth2, OpenID Connect, SAML), streamlining user experience. - -**PingIdentity:** -Ping Identity prioritizes a comprehensive user experience targeting both technical and non-technical users. Although it features a polished interface, the initial setup can be complex, resulting in a steeper learning curve for administrators. - -**Winner** - -Keycloak edges out in user-friendliness during initial setup and usability. - -### Scalability and Performance - -**Keycloak:** -With its cloud-native adaptation and support for high-volume user bases, Keycloak scales effectively to meet organizational needs. However, the management of a scaled Keycloak system can require significant time and resources without [proper enterprise support](https://phasetwo.io/support/). - -**PingIdentity:** -Ping Identity is designed for large-scale environments with robust scalability features, ensuring seamless performance under heavy loads, making it particularly suited for large organizations. - -**Winner** - -Ping Identity excels in scalability and performance, proving its capability to manage large-scale authentication requests. However, this comes at a larger cost which could be offset by taking on the management of Keycloak. - -### Pricing Model - -**Keycloak:** -Being open-source software, Keycloak has no licensing fees, making it highly cost-effective. However, organizations should consider potential indirect costs related to deployment and system management. - -**PingIdentity:** -Ping Identity operates on a traditional licensing model based on user count and features, which can lead to higher costs, particularly for larger deployments. - -**Winner** - -Keycloak is the clear winner for pricing, offering a more budget-friendly option. Coupled with a cost-conscious hosting provider, this can save a corporation literal millions of dollars over the course of an implementation. - -### Integration Ecosystem - -**Keycloak:** -Keycloak provides a strong API and powerful Admin portal, making it compatible with a wide range of frameworks like Spring Boot, Django, React, and more. Its supportive community extensions with integrations and continuous improvements, enhancing its adaptability. - -**PingIdentity:** -Ping Identity features a curated integration ecosystem focused on enterprise-level applications, providing documentation and support for integrations, but may lack the range of community-driven options available with Keycloak. - -**Winner** -Keycloak takes the lead for its extensive integration options and supportive community. Leverage [Phase Two's Free Hosting Tier](https://phasetwo.io/hosting/) to test and integrate Authorization and Authentication into an application(s). - -### Advanced Features - -**Keycloak:** -Keycloak supports fine-grained authorization and customizable themes, making it a flexible and cost-effective solution for diverse security needs. Its rapid adaptability to new technologies ensures organizations can stay relevant in a changing landscape. - -**PingIdentity:** -Ping Identity excels with advanced features such as fraud detection, identity verification, and robust orchestration capabilities, positioning it as a strong choice for larger enterprises requiring comprehensive security and compliance. - -**Winner** -Both Keycloak and Ping Identity offer valuable advanced features, with Keycloak providing flexibility for diverse environments, while Ping Identity delivers robust security measures suitable for complex enterprise needs. - -### Which one is best for me? - -Both Keycloak and Ping Identity provide essential IAM solutions, but their strengths cater to different organizational needs. Keycloak excels in customization, user experience, cost-effectiveness, and flexibility, making it ideal for organizations prioritizing quick adaptation and flexibility. In contrast, Ping Identity stands out with its hybrid deployment capabilities, scalability, and advanced security functionalities, positioning it as a strong choice for larger enterprises. Ultimately, the decision should align with the specific requirements, resources, and strategic goals of your organization. - -If you’re looking to [migrate to Keycloak](https://phasetwo.io/support/migrate-to-keycloak/), or have questions about Phase Two’s [enterprise support](https://phasetwo.io/support/), please [contact us](https://scheduler.zoom.us/phasetwo). diff --git a/blog/2024-08-10-keycloak-vs-frontegg.md b/blog/2024-08-10-keycloak-vs-frontegg.md deleted file mode 100644 index 533fe051..00000000 --- a/blog/2024-08-10-keycloak-vs-frontegg.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Keycloak vs. FrontEgg, an Open-Source Alternative -description: An in-depth comparison of Keycloak versus FrontEgg and why Keycloak is a strong alternative to a paid Authentication and Authorization service. -slug: keycloak-vs-frontegg-open-source-alternative -authors: phasetwo -tags: - [phase_two, open_source, authentication, authorization, frontegg, keycloak] ---- - -Keycloak and Frontegg are two prominent solutions in the identity and access management (IAM) space, each serving distinct needs. Keycloak is an open-source IAM solution with over eight years of development, known for its scalability and deep customization options, allowing organizations full control over user identity management. On the other hand, Frontegg is a cloud-native platform designed for quick deployment and integration, specifically tailored for SaaS applications, offering a user-friendly management experience. In this blog post, we will compare Keycloak and Frontegg based on cost structure, deployment options, customization, scalability, functionality, and support. - - - -### Cost Structure - -**Keycloak** -As an open-source solution, Keycloak is free to use, making it an attractive option for organizations of all sizes. While there are no licensing fees, organizations need to consider hosting costs and the resources required for system management. This cost model makes Keycloak particularly appealing for startups and enterprises that can manage their own infrastructure effectively. - -**Frontegg** -Frontegg operates on a subscription-based pricing model, starting with a free 30-day trial that unlocks all features. Following the trial, costs begin at $499 per month for the Growth Plan. While it simplifies IAM implementation and reduces developmental burden, organizations must weigh the recurring costs against the value gained from Frontegg's streamlined user management capabilities. -Frontegg provides a nice “free forever” tier that gives you enough to play with the platform. You would not want to use this for a production application with serious user covenants. To move upward, it is based on features and requires sales contact to assess pricing. While the next tiers allow for “growth to unlimited users”, pricing is heavily dependent on that usage. - -**Winner** - -Keycloak stands out as a more economically advantageous option, particularly for organizations with the technical capability to manage their own infrastructure. Leverage [Phase Two's Free Hosting Tier](https://phasetwo.io/hosting/) to test and integrate Authorization and Authentication into an application(s). - -### Deployment Options - -**Keycloak** -Keycloak offers flexibility in deployment, supporting both on-premises and cloud-based solutions. This capability allows organizations to maintain control over their identity management infrastructure, making it suitable for varying operational requirements and compliance needs. - -**Frontegg** -Frontegg is primarily a cloud-based solution designed for rapid deployment, offering a plug-and-play experience that facilitates quick integration into existing applications. While it doesn’t provide robust on-premises capabilities, it excels in cloud environments, catering particularly well to SaaS platforms aiming for fast time-to-market. - -**Winner** - -Keycloak offers superior deployment flexibility, accommodating both complex cloud and on-premises infrastructures. Frontegg, however, excels in ease of use for cloud-based deployments. - -### Customization and Branding - -**Keycloak** -Keycloak is renowned for its extensive customization options, enabling organizations to tailor authentication flows, user interfaces, and security protocols to meet their specific needs. Its open-source nature allows for modifications that avoid vendor lock-in, facilitating a user experience that matches organizational needs. While branding and theming Keycloak is possible, the current ability to do so is not straightforward. Phase Two has made this easier through extending the Keycloak Admin UI ([https://phasetwo.io/docs/getting-started/customizing-ui/](https://phasetwo.io/docs/getting-started/customizing-ui/)) which is available in all its [hosted](https://phasetwo.io/hosting/) offerings. - -**Frontegg** -Frontegg also provides customization capabilities but focuses on delivering a user-friendly interface that prioritizes speed and accessibility. It allows basic branding and minor adjustments but may not match the depth of customization available in Keycloak. The branding tool built by Frontegg is well done and prioritizes the user experience. - -**Winner** - -Keycloak takes the lead in customization and flexibility, providing organizations more granular control over user interfaces and workflows. While Frontegg leads with providing the a strong user experience for branding customization. - -### Scalability and Performance - -**Keycloak** -Keycloak is designed for high scalability, accommodating large user bases through horizontal scaling and clustered deployments. This architecture makes it suitable for extensive enterprise environments that require robust performance under varying loads. - -**Frontegg** -Frontegg is also built with scalability in mind, catering to growing SaaS applications through its multi-tenant architecture. While it's designed to manage increasing user volumes effectively, its performance may not yet match Keycloak's capabilities in extremely large-scale environments. - -**Winner** - -Keycloak is the preferred option for larger applications requiring robust scalability. However, Frontegg is well-suited for rapidly growing applications, especially in the SaaS space. - -### Functionality and Flexibility - -**Keycloak**:Keycloak provides a comprehensive suite of IAM features, including various authentication methods, fine-grained access control, and advanced identity federation capabilities. Its versatility in integrating with existing infrastructures makes Keycloak a powerful solution for complex IAM scenarios. - -**Frontegg** -Frontegg focuses on user management, facilitating seamless authentication and role management. Its end-to-end user management platform integrates easily with existing applications, offering a robust alternative for companies seeking quick implementation without extensive customization. - -**Winner** - -Keycloak leads in functionality and versatility, offering a broader range of advanced IAM features, making it a better choice for diverse security needs. Phase Two can provide [expert enterprise help](https://phasetwo.io/support/), custom development, and migrations. - -### Integration Capabilities - -**Keycloak** -Keycloak’s extensive integration capabilities include support for various identity providers and protocols like SAML, OAuth 2.0, and OpenID Connect. This allows organizations to leverage existing systems while enabling seamless authentication across applications. - -**Frontegg** -Frontegg also supports a wide range of integrations but primarily focuses on simplifying connections for SaaS applications. Its plug-and-play approach makes it easy to incorporate into existing products but may lack the depth of integration options available in Keycloak. - -**Winner** - -Keycloak emerges as the more versatile option, providing greater flexibility for organizations with complex integration requirements. Frontegg offers a great and easy interface to integrate with things they have support for. - -### Community and Support - -**Keycloak** -Keycloak benefits from a robust open-source community, with extensive documentation, forums, and active user contributions. Organizations can rely on community-driven support and resources to troubleshoot issues and share best practices. - -**Frontegg** -Frontegg provides dedicated customer support along with a library of resources. While still relatively new, it focuses on delivering good customer experiences and support for its users. Much of Frontegg’s Enterprise tier is focused on providing support. - -**Winner** - -Keycloak's established community offers a good way to get answers and help. Frontegg’s support channels are only available with the correct license. Phase Two helps to fill the gap between community help and Enterprise support ([https://phasetwo.io/support/](https://phasetwo.io/support/)). - -### How Should I Choose IAMs? - -Choosing the right IAM solution depends on your organization's specific needs and strategic goals. Keycloak is ideal for those seeking a customizable, open-source platform with extensive features and deployment flexibility. Frontegg, with its focus on rapid implementation and simplicity for SaaS applications, is a compelling option for tech companies looking to reduce development time and overhead. - -If you're looking to explore Keycloak further or have questions about [integrating](https://phasetwo.io/support/migrate-to-keycloak/) it into your organization, please [reach out for assistance](mailto:sales@phasetwo.io). The right IAM solution can help you secure your digital environment and streamline user management effectively. diff --git a/blog/2024-10-18-keycloak-for-startups-overview.md b/blog/2024-10-18-keycloak-for-startups-overview.md index c5877c2c..860d852c 100644 --- a/blog/2024-10-18-keycloak-for-startups-overview.md +++ b/blog/2024-10-18-keycloak-for-startups-overview.md @@ -12,7 +12,7 @@ In the ever-evolving landscape of Enterprise SaaS, navigating the complexities o There are a glut of commercial startups that solve some of the core challenges of authentication and authorization. But most of them rely on obscuring their true nature as a _commodity_ as a way of _marketing_ their products as _somehow differentiated_. -The purpose of this series is to dive into the key issues that separate an open source solution like Keycloak from commercial entities like [Auth0](./2024-05-01-alternatives-auth0.md), [Okta](./2024-06-03-alternatives-okta.md), or [WorkOs](./2024-07-22-keycloak-vs-workos.md). This should give a startup engineer or manager ample background to understand the decision, and to cut through the marketing gibberish. +The purpose of this series is to dive into the key issues that separate an open source solution like Keycloak from commercial entities like [Auth0](/keycloak-alternatives/auth0/), [Okta](/keycloak-alternatives/okta/), or [WorkOs](/keycloak-alternatives/workos/). This should give a startup engineer or manager ample background to understand the decision, and to cut through the marketing gibberish. This series will address the following key issues in 4 parts: diff --git a/blog/2024-11-04-keycloak-for-startups-customization.md b/blog/2024-11-04-keycloak-for-startups-customization.md index b1eba0da..775537e2 100644 --- a/blog/2024-11-04-keycloak-for-startups-customization.md +++ b/blog/2024-11-04-keycloak-for-startups-customization.md @@ -39,7 +39,7 @@ From branding and user interface customization to advanced authentication flows ### Why Customizability Matters in Comparison to Closed-Source Solutions -In contrast, commercial IAM solutions like [Auth0](./2024-05-01-alternatives-auth0.md) or [WorkOS](./2024-07-22-keycloak-vs-workos.md) often limit customization to predefined configuration options. These providers typically restrict access to source code and SPIs, which can prevent organizations from fully adapting the IAM solution to fit unique workflows, branding requirements, or security demands. Additionally, while some commercial IAM providers offer custom integrations or enhanced features, these are often gated behind higher-tier pricing plans, increasing costs as startups scale. +In contrast, commercial IAM solutions like [Auth0](/keycloak-alternatives/auth0/) or [WorkOS](/keycloak-alternatives/workos/) often limit customization to predefined configuration options. These providers typically restrict access to source code and SPIs, which can prevent organizations from fully adapting the IAM solution to fit unique workflows, branding requirements, or security demands. Additionally, while some commercial IAM providers offer custom integrations or enhanced features, these are often gated behind higher-tier pricing plans, increasing costs as startups scale. The flexibility Keycloak offers through customization allows startups to truly own their IAM strategy, aligning it directly with their brand identity, security protocols, and business objectives. By choosing Keycloak, startups retain the freedom to innovate at every layer of the IAM process, without being constrained by the limitations or financial restrictions imposed by closed-source, SaaS-based IAM providers. diff --git a/blog/2024-12-02-keycloak-for-startups-cost.md b/blog/2024-12-02-keycloak-for-startups-cost.md index a3547474..1779796f 100644 --- a/blog/2024-12-02-keycloak-for-startups-cost.md +++ b/blog/2024-12-02-keycloak-for-startups-cost.md @@ -49,7 +49,7 @@ While SaaS solutions like Auth0 and WorkOS offer convenience and ease of use, th ### Conclusion: Empowering Startups with Financial Freedom and Flexibility -In conclusion, the cost comparison between hosting an open-source product like Keycloak and opting for SaaS solutions like [Auth0](./2024-05-01-alternatives-auth0.md) and [WorkOS](./2024-07-22-keycloak-vs-workos.md) underscores the importance of financial freedom and flexibility for startups. +In conclusion, the cost comparison between hosting an open-source product like Keycloak and opting for SaaS solutions like [Auth0](/keycloak-alternatives/auth0/) and [WorkOS](/keycloak-alternatives/workos/) underscores the importance of financial freedom and flexibility for startups. By choosing Keycloak, startups can break free from the predatory pricing models of SaaS solutions, empowering themselves with a cost-effective and customizable IAM solution that aligns seamlessly with their budgetary constraints and growth objectives. With Keycloak, startups can redirect their financial resources towards innovation, differentiation, and sustainable growth, unlocking their full potential in the competitive landscape of Enterprise SaaS. diff --git a/docusaurus.config.js b/docusaurus.config.js index 0c5e4783..0f899f21 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -15,7 +15,7 @@ module.exports = { projectName: "p2-inc.github.io", deploymentBranch: "main", trailingSlash: true, - onBrokenAnchors: 'log', + onBrokenAnchors: "log", customFields: { caseStudyRequestEndpoint: process.env.CASE_STUDY_REQUEST_ENDPOINT || @@ -275,6 +275,7 @@ module.exports = { }, ], }, + { title: "Managed Hosting", description: "How we run it for you.", @@ -634,6 +635,10 @@ module.exports = { label: "Support", to: "pricing/support", }, + { + label: "Keycloak Alternatives", + to: "keycloak-alternatives", + }, ], megaMenu: { sections: [ @@ -656,6 +661,62 @@ module.exports = { }, ], }, + { + title: "Compare Keycloak", + description: "Keycloak vs. commercial IAM.", + accent: "blue", + links: [ + { + to: "keycloak-alternatives", + activeBasePath: "keycloak-alternatives", + label: "All Alternatives", + sub: "Compare Keycloak to commercial IAM", + icon: "grid", + }, + { + to: "keycloak-alternatives/auth0", + label: "vs Auth0", + sub: "Open-source alternative to Auth0", + icon: "scale", + }, + { + to: "keycloak-alternatives/okta", + label: "vs Okta", + sub: "Open-source alternative to Okta", + icon: "scale", + }, + { + to: "keycloak-alternatives/workos", + label: "vs WorkOS", + sub: "Open-source alternative to WorkOS", + icon: "scale", + }, + { + to: "keycloak-alternatives/ping-identity", + label: "vs Ping Identity", + sub: "Open-source alternative to Ping", + icon: "scale", + }, + { + to: "keycloak-alternatives/frontegg", + label: "vs FrontEgg", + sub: "Open-source alternative to FrontEgg", + icon: "scale", + }, + { + to: "keycloak-alternatives/onelogin", + label: "vs OneLogin", + sub: "Open-source alternative to OneLogin", + icon: "scale", + }, + { + to: "blog/open-source-iam", + label: "Open-Source IAM", + sub: "The roundup", + icon: "doc", + }, + ], + }, ], featured: [ { @@ -845,6 +906,11 @@ module.exports = { activeBasePath: "hosting", label: "Hosting", }, + { + to: "keycloak-alternatives", + activeBasePath: "keycloak-alternatives", + label: "Keycloak Alternatives", + }, { to: "product/sso", activeBasePath: "product/sso", @@ -1040,6 +1106,39 @@ module.exports = { ], ], plugins: [ + [ + "@docusaurus/plugin-client-redirects", + { + // Comparison blog posts migrated to evergreen /keycloak-alternatives// pages. + // Preserve link equity from the old (ranking) blog URLs. + redirects: [ + { + from: "/blog/keycloak-vs-auth0-open-source-alternative", + to: "/keycloak-alternatives/auth0/", + }, + { + from: "/blog/keycloak-vs-okta-open-source-alternative", + to: "/keycloak-alternatives/okta/", + }, + { + from: "/blog/keycloak-vs-workos-open-source-alternative", + to: "/keycloak-alternatives/workos/", + }, + { + from: "/blog/keycloak-vs-PingIdentity-open-source-alternative", + to: "/keycloak-alternatives/ping-identity/", + }, + { + from: "/blog/keycloak-vs-frontegg-open-source-alternative", + to: "/keycloak-alternatives/frontegg/", + }, + { + from: "/blog/keycloak-vs-onelogin-open-source-alternative", + to: "/keycloak-alternatives/onelogin/", + }, + ], + }, + ], [ "docusaurus-plugin-openapi-docs", { diff --git a/package.json b/package.json index 4069cad7..8481acec 100644 --- a/package.json +++ b/package.json @@ -20,6 +20,7 @@ "@docsearch/core": "4.5.0", "@docusaurus/core": "^3.10.1", "@docusaurus/faster": "^3.10.1", + "@docusaurus/plugin-client-redirects": "^3.10.1", "@docusaurus/plugin-content-blog": "^3.10.1", "@docusaurus/preset-classic": "^3.10.1", "@docusaurus/theme-common": "^3.10.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 95dbe64d..4545121f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -17,6 +17,9 @@ importers: '@docusaurus/faster': specifier: ^3.10.1 version: 3.10.1(@docusaurus/types@3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@swc/helpers@0.5.21)(postcss@8.5.14) + '@docusaurus/plugin-client-redirects': + specifier: ^3.10.1 + version: 3.10.1(@docusaurus/faster@3.10.1(@docusaurus/types@3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@swc/helpers@0.5.21)(postcss@8.5.14))(@mdx-js/react@3.1.1(@types/react@19.2.14)(react@18.3.1))(@rspack/core@1.7.11(@swc/helpers@0.5.21))(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) '@docusaurus/plugin-content-blog': specifier: ^3.10.1 version: 3.10.1(@docusaurus/faster@3.10.1(@docusaurus/types@3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@swc/helpers@0.5.21)(postcss@8.5.14))(@docusaurus/plugin-content-docs@3.10.1(@docusaurus/faster@3.10.1(@docusaurus/types@3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@swc/helpers@0.5.21)(postcss@8.5.14))(@mdx-js/react@3.1.1(@types/react@19.2.14)(react@18.3.1))(@rspack/core@1.7.11(@swc/helpers@0.5.21))(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@mdx-js/react@3.1.1(@types/react@19.2.14)(react@18.3.1))(@rspack/core@1.7.11(@swc/helpers@0.5.21))(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) @@ -1190,6 +1193,13 @@ packages: react: '*' react-dom: '*' + '@docusaurus/plugin-client-redirects@3.10.1': + resolution: {integrity: sha512-LHgd+YDvkhfOHMAE6XtUng3DQNzVM765RqVRrMJgHtzAvfopQhY6ieprqjxDVBdv21cLma6I0jHr+YCZH8fL9A==} + engines: {node: '>=20.0'} + peerDependencies: + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + '@docusaurus/plugin-content-blog@3.10.1': resolution: {integrity: sha512-mmkgE6Q2+K74tnkou7tXlpDLvoCU/qkSa2GSQ3XUiHWvcebCoDQzS670RR3tO8PmaWlIyWWISYWzZLuMfxunRA==} engines: {node: '>=20.0'} @@ -9627,6 +9637,43 @@ snapshots: - uglify-js - webpack-cli + '@docusaurus/plugin-client-redirects@3.10.1(@docusaurus/faster@3.10.1(@docusaurus/types@3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@swc/helpers@0.5.21)(postcss@8.5.14))(@mdx-js/react@3.1.1(@types/react@19.2.14)(react@18.3.1))(@rspack/core@1.7.11(@swc/helpers@0.5.21))(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)': + dependencies: + '@docusaurus/core': 3.10.1(@docusaurus/faster@3.10.1(@docusaurus/types@3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@swc/helpers@0.5.21)(postcss@8.5.14))(@mdx-js/react@3.1.1(@types/react@19.2.14)(react@18.3.1))(@rspack/core@1.7.11(@swc/helpers@0.5.21))(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + '@docusaurus/logger': 3.10.1 + '@docusaurus/utils': 3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + '@docusaurus/utils-common': 3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + '@docusaurus/utils-validation': 3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + eta: 2.2.0 + fs-extra: 11.3.5 + lodash: 4.18.1 + react: 18.3.1 + react-dom: 18.3.1(react@18.3.1) + tslib: 2.8.1 + transitivePeerDependencies: + - '@docusaurus/faster' + - '@mdx-js/react' + - '@minify-html/node' + - '@parcel/css' + - '@rspack/core' + - '@swc/core' + - '@swc/css' + - '@swc/html' + - bufferutil + - clean-css + - cssnano + - csso + - debug + - esbuild + - html-minifier-terser + - lightningcss + - postcss + - supports-color + - typescript + - uglify-js + - utf-8-validate + - webpack-cli + '@docusaurus/plugin-content-blog@3.10.1(@docusaurus/faster@3.10.1(@docusaurus/types@3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@swc/helpers@0.5.21)(postcss@8.5.14))(@docusaurus/plugin-content-docs@3.10.1(@docusaurus/faster@3.10.1(@docusaurus/types@3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@swc/helpers@0.5.21)(postcss@8.5.14))(@mdx-js/react@3.1.1(@types/react@19.2.14)(react@18.3.1))(@rspack/core@1.7.11(@swc/helpers@0.5.21))(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@mdx-js/react@3.1.1(@types/react@19.2.14)(react@18.3.1))(@rspack/core@1.7.11(@swc/helpers@0.5.21))(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)': dependencies: '@docusaurus/core': 3.10.1(@docusaurus/faster@3.10.1(@docusaurus/types@3.10.1(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(@swc/helpers@0.5.21)(postcss@8.5.14))(@mdx-js/react@3.1.1(@types/react@19.2.14)(react@18.3.1))(@rspack/core@1.7.11(@swc/helpers@0.5.21))(@swc/core@1.15.33(@swc/helpers@0.5.21))(postcss@8.5.14)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) diff --git a/src/components/CompareKeycloakBlock.jsx b/src/components/CompareKeycloakBlock.jsx new file mode 100644 index 00000000..0423515a --- /dev/null +++ b/src/components/CompareKeycloakBlock.jsx @@ -0,0 +1,44 @@ +import Link from "@docusaurus/Link"; +import React from "react"; + +/** + * Reusable cross-link block for the "Keycloak alternatives" cluster. + * Drop it on comparison-adjacent pages to point up to the hub and across to + * the sibling comparison pages. Keeps the hub-and-spoke internal linking + * consistent. Pass `exclude` (a vendor key) to hide the current page's own link. + */ +const LINKS = [ + { key: "auth0", label: "vs. Auth0", to: "/keycloak-alternatives/auth0/" }, + { key: "okta", label: "vs. Okta", to: "/keycloak-alternatives/okta/" }, + { key: "workos", label: "vs. WorkOS", to: "/keycloak-alternatives/workos/" }, + { key: "ping-identity", label: "vs. Ping Identity", to: "/keycloak-alternatives/ping-identity/" }, + { key: "frontegg", label: "vs. FrontEgg", to: "/keycloak-alternatives/frontegg/" }, + { key: "onelogin", label: "vs. OneLogin", to: "/keycloak-alternatives/onelogin/" }, +]; + +export default function CompareKeycloakBlock({ exclude }) { + const links = exclude ? LINKS.filter((l) => l.key !== exclude) : LINKS; + + return ( + + ); +} diff --git a/src/components/comparison/ComparisonLayout.jsx b/src/components/comparison/ComparisonLayout.jsx new file mode 100644 index 00000000..ce10f324 --- /dev/null +++ b/src/components/comparison/ComparisonLayout.jsx @@ -0,0 +1,233 @@ +import Head from "@docusaurus/Head"; +import Link from "@docusaurus/Link"; +import Layout from "@theme/Layout"; +import React from "react"; +import Cta from "../ctas/homepage-dual-line-cta"; +import CompareKeycloakBlock from "../CompareKeycloakBlock"; + +const HERO_IMG = "/img/hero-opensource-vs-commercial.svg"; +const SITE = "https://phasetwo.io"; + +/** + * Shared layout for the per-vendor "Keycloak vs. X" comparison pages under + * /keycloak-alternatives//. Content-driven so every page stays consistent. + * + * Props: + * - vendor: display name, e.g. "Auth0" + * - slug: url + cross-link key, e.g. "auth0" + * - meta: { title, description, keywords } + * - heroIntro: JSX paragraph under the H1 + * - atAGlance: [{ dim, vendor, keycloak }] rows for the at-a-glance table + * - sections: [{ title, body }] prose sections (body is JSX) + * - faqs: [{ q, a, text }] (a = JSX answer, text = plain-text for JSON-LD) + */ +export default function ComparisonLayout({ + vendor, + slug, + meta, + heroIntro, + atAGlance = [], + sections = [], + faqs = [], +}) { + const url = `${SITE}/keycloak-alternatives/${slug}/`; + + const faqJsonLd = { + "@context": "https://schema.org", + "@type": "FAQPage", + mainEntity: faqs.map((f) => ({ + "@type": "Question", + name: f.q, + acceptedAnswer: { "@type": "Answer", text: f.text }, + })), + }; + + const breadcrumbJsonLd = { + "@context": "https://schema.org", + "@type": "BreadcrumbList", + itemListElement: [ + { "@type": "ListItem", position: 1, name: "Home", item: `${SITE}/` }, + { + "@type": "ListItem", + position: 2, + name: "Keycloak Alternatives", + item: `${SITE}/keycloak-alternatives/`, + }, + { + "@type": "ListItem", + position: 3, + name: `Keycloak vs. ${vendor}`, + item: url, + }, + ], + }; + + return ( + + + {meta.keywords ? : null} + + + + + + {faqs.length ? ( + + ) : null} + + + +
+ {/* Hero */} +
+
+
+
+
+ +
+ +

+ + ← All Keycloak alternatives + +

+

Keycloak vs. {vendor}

+

{heroIntro}

+ +
+ + + + + See the comparison + +
+
+
+
+
+ + {/* At a glance */} + {atAGlance.length ? ( +
+
+
+

+ Keycloak vs. {vendor} at a glance +

+
+
+ + + + + + + + + + {atAGlance.map((row) => ( + + + + + + ))} + +
Dimension{vendor}Keycloak (with Phase Two)
{row.dim}{row.vendor}{row.keycloak}
+
+
+
+ ) : null} + + {/* Prose sections */} + {sections.map((s, i) => ( +
+
+
+

{s.title}

+
+ {s.body} +
+
+
+
+ ))} + + {/* Migration band */} +
+
+
+

Already using {vendor}?

+

+ Moving to Keycloak is more approachable than most teams expect. We import + users, broker authentication during a phased cutover, and move you off + {" "} + {vendor} without disrupting access. +

+
+ + See how we migrate teams to Keycloak + +
+
+
+
+ + {/* FAQ */} + {faqs.length ? ( +
+
+
+

Frequently asked questions

+
+
+ {faqs.map((f) => ( +
+

{f.q}

+
{f.a}
+
+ ))} +
+
+
+ ) : null} + + {/* Cross-links */} +
+
+ +
+
+ + {/* CTA */} + +
+ + ); +} diff --git a/src/css/custom.css b/src/css/custom.css index c4a75fa6..07271901 100644 --- a/src/css/custom.css +++ b/src/css/custom.css @@ -2697,3 +2697,105 @@ table.tw-table-pricing th { margin-top: 0; font-size: 13px; } + +/* ===================================================== + Keycloak Alternatives — comparison matrix + ===================================================== */ +.alternatives-matrix { + width: 100%; + border-collapse: collapse; + color: rgb(229, 231, 235); + font-size: 14.5px; + min-width: 720px; +} +.alternatives-matrix th, +.alternatives-matrix td { + text-align: left; + vertical-align: top; + padding: 14px 16px; + border-bottom: 1px solid rgba(255, 255, 255, 0.1); +} +.alternatives-matrix thead th { + font-size: 12px; + font-weight: 600; + letter-spacing: 0.06em; + text-transform: uppercase; + color: rgb(156, 163, 175); + border-bottom-color: rgba(255, 255, 255, 0.18); +} +.alternatives-matrix tbody th[scope="row"] { + font-weight: 600; + color: #fff; + white-space: nowrap; +} +.alternatives-matrix tbody tr:hover { + background: rgba(255, 255, 255, 0.02); +} +.alternatives-matrix a { + font-weight: 600; + white-space: nowrap; +} +.alternatives-matrix-keycloak { + background: color-mix(in srgb, var(--ifm-color-primary) 12%, transparent); +} +.alternatives-matrix-keycloak:hover { + background: color-mix(in srgb, var(--ifm-color-primary) 16%, transparent) !important; +} +.alternatives-matrix-keycloak th[scope="row"] { + white-space: normal; +} + +/* Reusable cross-link block (CompareKeycloakBlock) */ +.compare-keycloak-block { + margin: 24px auto; + max-width: var(--content-width-wide); + padding: 24px; + border-radius: 16px; + border: 1px solid rgba(255, 255, 255, 0.1); + background: linear-gradient(180deg, #1a1a1a 0%, #131313 100%); +} +.compare-keycloak-block-title { + color: #fff; + margin: 0; + font-size: 18px; +} +.compare-keycloak-block-sub { + color: rgb(156, 163, 175); + font-size: 14px; + margin: 6px 0 0; +} +.compare-keycloak-block-links { + display: flex; + flex-wrap: wrap; + gap: 8px 18px; + list-style: none; + margin: 16px 0; + padding: 0; +} +.compare-keycloak-block-links > li { + margin: 0; + padding: 0; +} +.compare-keycloak-block-links a { + font-weight: 600; + font-size: 14.5px; +} + +/* Per-vendor comparison page prose */ +.comparison-prose p { + margin-bottom: 0; +} +.comparison-prose ul { + list-style: disc; + padding-left: 1.5rem; + margin: 0; +} +.comparison-prose li { + margin: 4px 0; +} +.comparison-prose a { + font-weight: 600; +} +.comparison-prose strong { + color: #fff; +} diff --git a/src/pages/hosting/self-host-vs-managed.jsx b/src/pages/hosting/self-host-vs-managed.jsx index 28bbda0b..6a9ea170 100644 --- a/src/pages/hosting/self-host-vs-managed.jsx +++ b/src/pages/hosting/self-host-vs-managed.jsx @@ -5,6 +5,7 @@ import IconExpense from "@site/static/img/icon-expense.svg"; import CardWithImage from "../../components/CardWithImage"; import CardWithIcon from "../../components/CardWithIcon"; import Cta from "../../components/ctas/homepage-dual-line-cta"; +import CompareKeycloakBlock from "../../components/CompareKeycloakBlock"; const PLACEHOLDER_IMG = "/img/placeholder.svg"; const BENEFIT_IMAGES = [ @@ -179,6 +180,13 @@ export default function SelfHostVsManaged() { + {/* Compare to commercial IAM vendors */} +
+
+ +
+
+ {/* CTA */} + Keycloak is the most widely adopted open-source alternative to Auth0. It supports the same + core standards (OAuth 2.0, OpenID Connect, SAML) and matches Auth0 on most authentication + and authorization features, while being free of per-user licensing. The main trade-off is + operational overhead, which a managed host like Phase Two removes. See our full{" "} + Keycloak vs. Auth0{" "} + comparison. +

+ ), + }, + { + q: "What is the best alternative to Okta?", + a: ( +

+ For teams that want control over deployment and cost, Keycloak is a strong Okta alternative — + especially where on-premise or data-residency requirements rule out a cloud-only vendor. + Read{" "} + Keycloak vs. Okta for a + feature-by-feature look. +

+ ), + }, + { + q: "Is Keycloak cheaper than Auth0?", + a: ( +

+ For most growing applications, yes. Commercial IAM pricing scales with monthly active users + and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays + largely fixed as your user base grows. Teams moving to managed Keycloak frequently see + substantial savings. Estimate it on our{" "} + hosting pricing page. +

+ ), + }, + { + q: "Can I migrate off Auth0, Okta, or Cognito to Keycloak?", + a: ( +

+ Yes. Keycloak can import your users and broker authentication to your existing provider + during a phased cutover, so you can migrate incrementally without disrupting users. We've + built tooling and a process for exactly this — see{" "} + Migrate to Keycloak. +

+ ), + }, + { + q: "Is Keycloak a good alternative to commercial IAM?", + a: ( +

+ Keycloak offers feature parity with virtually every commercial IAM platform on the core + standards, plus full source access and on-premise deployment options that SaaS-only vendors + can't match. Paired with managed hosting, you get that openness without the operational + burden. Read the{" "} + open-source IAM overview. +

+ ), + }, +]; + +export default function KeycloakAlternatives() { + const faqJsonLd = { + "@context": "https://schema.org", + "@type": "FAQPage", + mainEntity: FAQS.map((f) => ({ + "@type": "Question", + name: f.q, + acceptedAnswer: { + "@type": "Answer", + // Plain-text answers for the FAQ rich result. + text: + { + "What is the best open-source alternative to Auth0?": + "Keycloak is the most widely adopted open-source alternative to Auth0. It supports OAuth 2.0, OpenID Connect, and SAML and matches Auth0 on most features, without per-user licensing. A managed host like Phase Two removes the operational overhead.", + "What is the best alternative to Okta?": + "Keycloak is a strong Okta alternative for teams that want control over deployment and cost, especially where on-premise or data-residency requirements rule out a cloud-only vendor.", + "Is Keycloak cheaper than Auth0?": + "For most growing applications, yes. Commercial IAM pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows.", + "Can I migrate off Auth0, Okta, or Cognito to Keycloak?": + "Yes. Keycloak can import your users and broker authentication to your existing provider during a phased cutover, so you can migrate incrementally without disrupting users.", + "Is Keycloak a good alternative to commercial IAM?": + "Keycloak offers feature parity with commercial IAM platforms on core standards, plus full source access and on-premise deployment options. Paired with managed hosting, you get that openness without the operational burden.", + }[f.q] || "", + }, + })), + }; + + const itemListJsonLd = { + "@context": "https://schema.org", + "@type": "ItemList", + name: "Keycloak vs. commercial IAM comparisons", + itemListElement: COMPARISONS.map((c, i) => ({ + "@type": "ListItem", + position: i + 1, + name: `Keycloak vs. ${c.vendor}`, + url: `https://phasetwo.io${c.to}`, + })), + }; + + const breadcrumbJsonLd = { + "@context": "https://schema.org", + "@type": "BreadcrumbList", + itemListElement: [ + { "@type": "ListItem", position: 1, name: "Home", item: "https://phasetwo.io/" }, + { + "@type": "ListItem", + position: 2, + name: "Keycloak Alternatives", + item: PAGE_META.url, + }, + ], + }; + + return ( + + + + + + + + + + + + + +
+ {/* Hero */} +
+
+
+
+
+ +
+ +

Keycloak Alternatives

+

+ Evaluating Auth0, Okta, WorkOS, or another commercial IAM? Keycloak is the + open-source alternative that matches them on standards and features — without + per-user licensing or vendor lock-in. Paired with Phase Two managed hosting, you + get that control with fixed, predictable costs and none of the operational burden. +

+ +
+ + + + + Compare the platforms + +
+
+
+
+
+ + {/* Intro */} +
+
+
+

+ On the core standards — OIDC, OAuth 2.0, and SAML — Keycloak offers parity with + virtually every commercial IAM platform. The real differences are cost model, + deployment flexibility, and how far you can extend the system. Here's how Keycloak + compares to the vendors teams ask us about most. +

+
+
+
+ + {/* Comparison matrix */} +
+
+
+

Keycloak vs. commercial IAM at a glance

+

+ A high-level view of how each platform is licensed and deployed. Follow any row for + the full, feature-by-feature comparison. +

+
+ +
+ + + + + + + + + + + + + + + + + + + + + {COMPARISONS.map((c) => ( + + + + + + + + + ))} + +
PlatformPricing modelDeploymentOn-premiseBest known forCompare
Keycloak (with Phase Two)Fixed hosting cost, not per-userSelf-hosted, your cloud, on-prem, or managedYesOpen-source, extensible IAM + Managed hosting → +
{c.vendor}{c.pricing}{c.deployment}{c.onPrem}{c.knownFor} + Keycloak vs. {c.vendor} → +
+
+ +

+ Pricing models are summarized for orientation and reflect each vendor's general + approach, not a quote. Commercial pricing changes frequently — confirm current rates + with each vendor.{" "} + {/* TODO: verify — keep cells qualitative; do not insert specific competitor prices without a source. */} +

+ +
+ + Read the open-source IAM overview + +
+
+
+ + {/* Migration band */} +
+
+
+

Already on Auth0, Okta, or Cognito?

+

+ Moving to Keycloak is more approachable than most teams expect. We import users, + broker authentication during a phased cutover, and move you off your current vendor + without disrupting access. +

+
+ + See how we migrate teams to Keycloak + +
+
+
+
+ + {/* FAQ */} +
+
+
+

Frequently asked questions

+
+
+ {FAQS.map((f) => ( +
+

{f.q}

+
{f.a}
+
+ ))} +
+
+
+ + {/* CTA */} + +
+ + ); +} diff --git a/src/pages/keycloak-alternatives/auth0.jsx b/src/pages/keycloak-alternatives/auth0.jsx new file mode 100644 index 00000000..94d23d1a --- /dev/null +++ b/src/pages/keycloak-alternatives/auth0.jsx @@ -0,0 +1,267 @@ +import Link from "@docusaurus/Link"; +import React from "react"; +import ComparisonLayout from "../../components/comparison/ComparisonLayout"; + +const meta = { + title: "Keycloak vs. Auth0: The Open-Source Alternative (2026 Guide)", + description: + "A 2026 comparison of Keycloak vs. Auth0 — cost, deployment, maintenance, and features — and why managed Keycloak is a strong open-source alternative to Auth0.", + keywords: + "keycloak vs auth0, auth0 alternative, open source auth0 alternative, auth0 pricing, managed keycloak", +}; + +const heroIntro = ( + <> + Auth0 is a popular, fully managed cloud platform; Keycloak is the open-source alternative + that competes strongly on cost, control, and flexibility. Here's how the two compare across + cost of ownership, deployment, maintenance, and features — and why pairing Keycloak with a + managed host like Phase Two often gives you the best of both. + +); + +const atAGlance = [ + { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, + { dim: "Pricing driver", vendor: "Per monthly active user (MAU) + features", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, + { dim: "Cost predictability", vendor: "Scales with users and features", keycloak: "Predictable; decoupled from user growth" }, + { dim: "Deployment", vendor: "Cloud SaaS only", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, + { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML", keycloak: "OAuth 2.0, OIDC, SAML" }, + { dim: "Extensibility", vendor: "Actions framework (bounded)", keycloak: "Full source access + SPIs/extensions" }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, +]; + +const sections = [ + { + title: "Cost of Ownership", + body: ( + <> +

+ Auth0 operates on a subscription model that can be appealing for startups or small + projects. Its free tier is generous on paper — up to 25,000 monthly active users (MAU) — + but it's bounded on connections, organizations, and features, and most production + workloads quickly outgrow it. +

+

+ Here's the catch: Auth0's list prices look modest until you map them to how a real + application actually uses the platform. As of 2026, Auth0's published pricing (per month, + billed monthly) scales like this: +

+
+ + + + + + + + + + + + + + + +
Monthly active usersB2C EssentialsB2C ProfessionalB2B Essentials
1,000$70$240$300
5,000$350$1,000$1,300
10,000$700$1,600$2,100
20,000$1,400$3,200$3,800
+
+

+ Figures reflect Auth0's published list pricing as of 2026 ( + auth0.com/pricing + ); Auth0 changes pricing periodically, so confirm current rates for your tier and region. +

+

Two things push the real bill well beyond the headline numbers:

+
    +
  • + The features you actually need live in higher tiers and add-ons. SAML, + LDAP/Active Directory federation, and log streaming move you up a band — and several + common needs are billed as separate line items. Additional enterprise SSO connections + run about $100/month each on B2B plans; MFA is a $100/month add-on on B2B + Essentials; machine-to-machine (M2M) tokens are metered separately (up to roughly + $1,200/month for 300,000 tokens); and the newer AI Agents add-on is priced at 50% of + your base subscription. +
    • +
  • + "Users" and "organizations" aren't cheap. If you sell to businesses, + Auth0's B2B model is the one that fits — and it costs materially more than B2C at the + same scale (for example, $3,800/month for B2B Essentials vs. $1,400/month for + B2C Essentials at 20,000 MAU). Organizations, enterprise connections, and + per-customer SSO all push the number up. +
    • +
+

+ For anything beyond mid-size, Auth0 routes you into a custom Enterprise contract. In + practice those negotiations tend to land in the six figures annually — we routinely talk + to teams whose Auth0 quotes target $100K+ per year once SSO, MFA, + organizations, and log streaming are bundled in. The problem isn't that any single number + is outrageous; it's that the total is hard to predict and climbs with every feature and + every user you add. +

+

+ Keycloak, by contrast, is free to use regardless of users or scale. The primary cost is + hosting and operating the software, which means your spend tends to be fixed, + driven by infrastructure rather than user counts or feature gates.{" "} + Winner: Keycloak. See a side-by-side{" "} + pricing estimate vs. Auth0. +

+ + ), + }, + { + title: "Architecture and Deployment", + body: ( + <> +

+ Auth0 is a cloud-based service, so there's little infrastructure to set up. That enables + quick deployment and removes much of the DevOps burden. The trade-off: enterprises with + strict regulatory or data-residency requirements often need on-premise options that a + SaaS-only model can't provide. +

+

+ Keycloak can be deployed on-premise, in your own cloud, or via a{" "} + managed cloud service. Because you control the deployment + environment, it conforms to compliance and data-sovereignty needs.{" "} + Winner: Depends. If you need on-premise or strict data control, Keycloak + wins clearly — and it still gives you the flexibility to{" "} + self-host or use managed hosting. +

+ + ), + }, + { + title: "Maintenance", + body: ( + <> +

+ As a managed service, Auth0 requires minimal maintenance from your side — it handles + updates, security patches, and infrastructure. +

+

+ Self-hosted Keycloak requires more attention: installation, configuration, upgrades, and + the underlying infrastructure. Phase Two removes this trade-off entirely: with{" "} + managed hosting and{" "} + zero-downtime upgrades, you get + Keycloak's control without the operational load.{" "} + Winner: Auth0 for self-hosted Keycloak; a tie when Keycloak is managed by Phase + Two. +

+ + ), + }, + { + title: "Functionality and Flexibility", + body: ( + <> +

+ Auth0 offers a broad set of authentication features out of the box — social logins, + enterprise federation, database connections — and supports OAuth 2.0, OpenID Connect, and + SAML. Customization happens through its Actions framework, which can become difficult to + manage as logic grows outside the main application. +

+

+ Keycloak matches Auth0 on core functionality and the same protocols, with customizable + login, registration, and account-management UIs. Being open source, it lets developers + extend the codebase far more freely — a higher ceiling for customization. A standout + capability is Keycloak's on-premise deployment options.{" "} + Winner: Keycloak. The two are comparable on features, but Keycloak is far + more extensible and configurable. +

+ + ), + }, + { + title: "Migrating from Auth0 to Keycloak", + body: ( + <> +

+ Moving off Auth0 is more approachable than many teams expect. Keycloak imports users, + supports gradual cutover, and brokers identities so you can transition without disrupting + access — see Migrate to Keycloak. +

+

+ You can also run Keycloak alongside Auth0 during a transition: Keycloak can act + as a broker that delegates authentication to an external IdP such as Auth0. That lets you + keep existing Auth0 connections while Keycloak handles internal permissions, roles, and a + consistent login experience — a low-risk path to migrating one piece at a time. +

+ + ), + }, +]; + +const faqs = [ + { + q: "Is Keycloak a good alternative to Auth0?", + a: ( +

+ Yes. Keycloak supports the same core standards as Auth0 (OAuth 2.0, OpenID Connect, SAML) + and matches it on most authentication and authorization features, while being open source + and free of per-user licensing. The main trade-off is operational overhead, which a managed + host like Phase Two removes. +

+ ), + text: + "Yes. Keycloak supports the same core standards as Auth0 (OAuth 2.0, OpenID Connect, SAML) and matches it on most features, while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + }, + { + q: "Is Keycloak cheaper than Auth0?", + a: ( +

+ For most growing applications, yes. Auth0 pricing scales with monthly active users and + feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely + fixed as your user base grows. Teams moving from Auth0 to managed Keycloak frequently see + substantial savings. +

+ ), + text: + "For most growing applications, yes. Auth0 pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows.", + }, + { + q: "Can I migrate from Auth0 to Keycloak?", + a: ( +

+ Yes. Keycloak can import your users and broker authentication to Auth0 during a phased + cutover, so you can migrate incrementally without disrupting users. See{" "} + Migrate to Keycloak. +

+ ), + text: + "Yes. Keycloak can import your users and broker authentication to Auth0 during a phased cutover, so you can migrate incrementally without disrupting users.", + }, + { + q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", + a: ( +

+ Yes. Keycloak is built on these standards and interoperates with both modern applications + and legacy systems, including LDAP and Active Directory. +

+ ), + text: + "Yes. Keycloak is built on these standards and interoperates with both modern applications and legacy systems, including LDAP and Active Directory.", + }, + { + q: "Can Keycloak be self-hosted or run on-premise?", + a: ( +

+ Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This + flexibility is a key advantage over Auth0's cloud-only model, especially for data-residency + and compliance requirements. +

+ ), + text: + "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over Auth0's cloud-only model, especially for data-residency and compliance requirements.", + }, +]; + +export default function KeycloakVsAuth0() { + return ( + + ); +} diff --git a/src/pages/keycloak-alternatives/frontegg.jsx b/src/pages/keycloak-alternatives/frontegg.jsx new file mode 100644 index 00000000..f29256d7 --- /dev/null +++ b/src/pages/keycloak-alternatives/frontegg.jsx @@ -0,0 +1,324 @@ +import Link from "@docusaurus/Link"; +import React from "react"; +import ComparisonLayout from "../../components/comparison/ComparisonLayout"; + +const meta = { + title: "Keycloak vs. FrontEgg: The Open-Source Alternative", + description: + "An in-depth comparison of Keycloak vs. FrontEgg — cost, deployment, customization, scalability, and support — and why open-source Keycloak is a strong alternative to FrontEgg's SaaS-focused user management platform.", + keywords: + "keycloak vs frontegg, frontegg alternative, open source frontegg alternative, frontegg pricing, managed keycloak, b2b user management", +}; + +const heroIntro = ( + <> + FrontEgg is a cloud-native platform built for embedded B2B user management in SaaS + applications; Keycloak is the open-source alternative that gives you the same authentication + and authorization capabilities with full control over cost, deployment, and customization. + Here's how the two compare — and why pairing Keycloak with a managed host like Phase Two often + gives you the best of both. + +); + +const atAGlance = [ + { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, + { dim: "Pricing driver", vendor: "Per-feature tiers + usage; sales-gated above the entry plan", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, + { dim: "Cost predictability", vendor: "Scales with features and user volume", keycloak: "Predictable; decoupled from user growth" }, + { dim: "Deployment", vendor: "Cloud SaaS, no robust on-premise option", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, + { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML", keycloak: "OAuth 2.0, OIDC, SAML" }, + { dim: "Extensibility", vendor: "Bounded; plug-and-play, SaaS-focused", keycloak: "Full source access + SPIs/extensions" }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, +]; + +const sections = [ + { + title: "Cost Structure", + body: ( + <> +

+ As an open-source solution, Keycloak is free to use, making it an attractive option for + organizations of all sizes. While there are no licensing fees, organizations need to + consider hosting costs and the resources required for system management. This cost model + makes Keycloak particularly appealing for startups and enterprises that can manage their + own infrastructure effectively. +

+

+ FrontEgg operates on a subscription-based pricing model, starting with a free trial that + unlocks the platform's features. After the trial, paid plans require an ongoing + subscription, and pricing climbs as you adopt more capabilities. FrontEgg also offers a + generous "free forever" tier that gives you enough to evaluate the platform — but it isn't + intended for a production application with serious user commitments. Moving up is driven by + features and typically requires contacting sales to assess pricing. While the higher tiers + promise growth toward unlimited users, the cost is heavily dependent on usage. +

+

+ While FrontEgg simplifies IAM implementation and reduces the development burden, + organizations must weigh the recurring, usage-driven costs against the value gained from + its streamlined user management.{" "} + Winner: Keycloak — a more economically advantageous option, particularly + for organizations with the technical capability to manage their own infrastructure. + Leverage Phase Two's hosting to test and integrate + authentication and authorization into your application(s), and see a side-by-side{" "} + pricing estimate. +

+ + ), + }, + { + title: "Deployment Options", + body: ( + <> +

+ Keycloak offers flexibility in deployment, supporting both on-premises and cloud-based + solutions. This capability allows organizations to maintain control over their identity + management infrastructure, making it suitable for varying operational requirements and + compliance needs. +

+

+ FrontEgg is primarily a cloud-based solution designed for rapid deployment, offering a + plug-and-play experience that facilitates quick integration into existing applications. + While it doesn't provide robust on-premises capabilities, it excels in cloud environments, + catering particularly well to SaaS platforms aiming for fast time-to-market. +

+

+ + Winner: Keycloak offers superior deployment flexibility, accommodating both complex + cloud and on-premises infrastructures. + {" "} + FrontEgg, however, excels in ease of use for cloud-based deployments. Keycloak still gives + you the choice to deploy on-premise or to{" "} + self-host or use managed hosting. +

+ + ), + }, + { + title: "Customization and Branding", + body: ( + <> +

+ Keycloak is renowned for its extensive customization options, enabling organizations to + tailor authentication flows, user interfaces, and security protocols to meet their + specific needs. Its open-source nature allows for modifications that avoid vendor lock-in, + facilitating a user experience that matches organizational needs. While branding and + theming Keycloak is possible, doing so isn't always straightforward out of the box. Phase + Two has made this easier by extending the Keycloak Admin UI, a capability available across + all of its hosted offerings. +

+

+ FrontEgg also provides customization capabilities but focuses on delivering a user-friendly + interface that prioritizes speed and accessibility. It allows basic branding and minor + adjustments but may not match the depth of customization available in Keycloak. The + branding tool FrontEgg built is well done and prioritizes the user experience. +

+

+ Winner: Keycloak takes the lead in customization and flexibility, + providing organizations more granular control over user interfaces and workflows — while + FrontEgg leads with a strong user experience for branding customization. +

+ + ), + }, + { + title: "Scalability and Performance", + body: ( + <> +

+ Keycloak is designed for high scalability, accommodating large user bases through + horizontal scaling and clustered deployments. This architecture makes it suitable for + extensive enterprise environments that require robust performance under varying loads. +

+

+ FrontEgg is also built with scalability in mind, catering to growing SaaS applications + through its multi-tenant architecture. While it's designed to manage increasing user + volumes effectively, its performance may not yet match Keycloak's capabilities in + extremely large-scale environments. +

+

+ + Winner: Keycloak is the preferred option for larger applications requiring robust + scalability. + {" "} + However, FrontEgg is well-suited for rapidly growing applications, especially in the SaaS + space. +

+ + ), + }, + { + title: "Functionality and Flexibility", + body: ( + <> +

+ Keycloak provides a comprehensive suite of IAM features, including various authentication + methods, fine-grained access control, and advanced identity federation capabilities. Its + versatility in integrating with existing infrastructures makes Keycloak a powerful solution + for complex IAM scenarios. +

+

+ FrontEgg focuses on user management, facilitating seamless authentication and role + management. Its end-to-end user management platform integrates easily with existing + applications, offering a robust alternative for companies seeking quick implementation + without extensive customization. +

+

+ Winner: Keycloak leads in functionality and versatility, offering a + broader range of advanced IAM features, making it a better choice for diverse security + needs. Phase Two can provide expert enterprise help, custom development, and{" "} + migrations. +

+ + ), + }, + { + title: "Integration Capabilities", + body: ( + <> +

+ Keycloak's extensive integration capabilities include support for various identity + providers and protocols like SAML, OAuth 2.0, and OpenID Connect. This allows + organizations to leverage existing systems while enabling seamless authentication across + applications. +

+

+ FrontEgg also supports a wide range of integrations but primarily focuses on simplifying + connections for SaaS applications. Its plug-and-play approach makes it easy to incorporate + into existing products but may lack the depth of integration options available in Keycloak. +

+

+ Winner: Keycloak emerges as the more versatile option, providing greater + flexibility for organizations with complex integration requirements. FrontEgg offers a + great and easy interface to integrate with the providers and protocols it supports. +

+ + ), + }, + { + title: "Community and Support", + body: ( + <> +

+ Keycloak benefits from a robust open-source community, with extensive documentation, + forums, and active user contributions. Organizations can rely on community-driven support + and resources to troubleshoot issues and share best practices. +

+

+ FrontEgg provides dedicated customer support along with a library of resources. While still + relatively new, it focuses on delivering good customer experiences and support for its + users. Much of FrontEgg's Enterprise tier is focused on providing that support. +

+

+ + Winner: Keycloak's established community offers a good way to get answers and help. + {" "} + FrontEgg's support channels are only available with the right license. Phase Two helps fill + the gap between community help and Enterprise support — see{" "} + how we support and migrate teams to Keycloak. +

+ + ), + }, + { + title: "How Should I Choose an IAM?", + body: ( + <> +

+ Choosing the right IAM solution depends on your organization's specific needs and strategic + goals. Keycloak is ideal for those seeking a customizable, open-source platform with + extensive features and deployment flexibility. FrontEgg, with its focus on rapid + implementation and simplicity for SaaS applications, is a compelling option for tech + companies looking to reduce development time and overhead. +

+

+ If you're looking to explore Keycloak further or have questions about{" "} + integrating it into your organization,{" "} + reach out for assistance. The right IAM solution can + help you secure your digital environment and streamline user management effectively. +

+ + ), + }, +]; + +const faqs = [ + { + q: "Is Keycloak a good alternative to FrontEgg?", + a: ( +

+ Yes. Keycloak supports the same core standards as FrontEgg (OAuth 2.0, OpenID Connect, SAML) + and provides a comprehensive set of authentication and authorization features, while being + open source and free of subscription licensing. FrontEgg excels at plug-and-play B2B user + management for SaaS, but Keycloak offers deeper customization, deployment flexibility, and + lower long-term cost. +

+ ), + text: + "Yes. Keycloak supports the same core standards as FrontEgg (OAuth 2.0, OpenID Connect, SAML) and provides a comprehensive set of features, while being open source and free of subscription licensing. FrontEgg excels at plug-and-play B2B user management for SaaS, but Keycloak offers deeper customization, deployment flexibility, and lower long-term cost.", + }, + { + q: "Is Keycloak cheaper than FrontEgg?", + a: ( +

+ For most organizations that can manage their own infrastructure, yes. FrontEgg uses a + subscription model where cost is driven by features and usage and often requires a sales + conversation as you grow. Keycloak has no licensing fees — your cost is hosting and + operations, which stays largely fixed as your user base grows. +

+ ), + text: + "For most organizations that can manage their own infrastructure, yes. FrontEgg uses a subscription model where cost is driven by features and usage. Keycloak has no licensing fees — your cost is hosting and operations, which stays largely fixed as your user base grows.", + }, + { + q: "Can Keycloak be self-hosted or run on-premise?", + a: ( +

+ Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This is a key + advantage over FrontEgg, which is primarily a cloud-based SaaS without robust on-premises + capabilities — making Keycloak the better fit for data-residency and compliance requirements. +

+ ), + text: + "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This is a key advantage over FrontEgg, which is primarily a cloud-based SaaS without robust on-premises capabilities.", + }, + { + q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", + a: ( +

+ Yes. Keycloak is built on these standards and supports a wide range of identity providers, + allowing organizations to leverage existing systems while enabling seamless authentication + across applications. +

+ ), + text: + "Yes. Keycloak is built on these standards and supports a wide range of identity providers, allowing organizations to leverage existing systems while enabling seamless authentication across applications.", + }, + { + q: "How customizable is Keycloak compared to FrontEgg?", + a: ( +

+ Keycloak is far more customizable. You can tailor authentication flows, user interfaces, and + security protocols, and because it's open source you can modify the codebase directly to + avoid vendor lock-in. FrontEgg offers a polished, user-friendly branding experience but more + limited depth. Phase Two makes Keycloak customization easier by extending the Admin UI across + its hosted offerings. +

+ ), + text: + "Keycloak is far more customizable. You can tailor authentication flows, user interfaces, and security protocols, and because it's open source you can modify the codebase directly to avoid vendor lock-in. FrontEgg offers a polished branding experience but more limited depth.", + }, +]; + +export default function KeycloakVsFrontEgg() { + return ( + + ); +} diff --git a/src/pages/keycloak-alternatives/okta.jsx b/src/pages/keycloak-alternatives/okta.jsx new file mode 100644 index 00000000..d0fd5cc2 --- /dev/null +++ b/src/pages/keycloak-alternatives/okta.jsx @@ -0,0 +1,284 @@ +import Link from "@docusaurus/Link"; +import React from "react"; +import ComparisonLayout from "../../components/comparison/ComparisonLayout"; + +const meta = { + title: "Keycloak vs. Okta: The Open-Source Alternative", + description: + "An in-depth comparison of Keycloak vs. Okta — cost of ownership, deployment, maintenance, and features — and why managed Keycloak is a strong open-source alternative to Okta.", + keywords: + "keycloak vs okta, okta alternative, open source okta alternative, okta pricing, managed keycloak, okta sso alternative", +}; + +const heroIntro = ( + <> + Okta is a leading cloud-based IAM provider that promises quick deployment and comprehensive + SSO and security features through a subscription service. Keycloak is the open-source + alternative that competes strongly on cost, control, and flexibility. Here's how the two + compare across cost of ownership, deployment, maintenance, and features — and why pairing + Keycloak with a managed host like Phase Two often gives you the best of both. + +); + +const atAGlance = [ + { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, + { dim: "Pricing driver", vendor: "Per-user + per-feature subscription", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, + { dim: "Cost predictability", vendor: "Scales with users and features; can balloon at enterprise scale", keycloak: "Predictable; decoupled from user growth" }, + { dim: "Deployment", vendor: "Cloud SaaS only", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, + { dim: "Standards", vendor: "SAML, OpenID Connect, OAuth 2.0", keycloak: "SAML, OpenID Connect, OAuth 2.0" }, + { dim: "Extensibility", vendor: "Limited customization", keycloak: "Full source access + SPIs/extensions, themes, custom code" }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, +]; + +const sections = [ + { + title: "Cost of Ownership", + body: ( + <> +

+ When evaluating IAM solutions, both upfront cost and total cost of ownership (TCO) + matter. Okta operates on a subscription-based pricing model, with costs varying based on + the number of users and the features you select. As a SaaS solution, it bundles + infrastructure, maintenance, and support into its subscription fees, which reduces + internal IT burden — Okta handles updates, patches, and system maintenance. +

+

+ The catch is that per-user costs add up, especially for larger organizations. With every + feature enabled, the per-user cost grows significantly, and bills can climb into + enterprise bands quickly. While Okta provides scalability, letting businesses grow without + worrying about infrastructure investments, the costs that are incurred can balloon far + beyond the original projections and become a large piece of overall IT spend. +

+

+ Keycloak, by contrast, is an open-source solution developed by Red Hat and is free to use + regardless of the number of users or the scale of the project. There are no licensing + fees. It does, however, require infrastructure to{" "} + host and run the application — cloud services or on-premise + hardware — plus resources to maintain, update, and customize it. The primary cost comes + from self-hosting and managing the software, which means your spend tends to be{" "} + fixed: it's driven by infrastructure rather than by features or user + counts. +

+

+ Winner: Keycloak. Leveraging Phase Two's{" "} + managed hosting provides a more capable free tier to test and + integrate authentication and authorization into your applications. As an application's + needs grow for users and integrations, Keycloak quickly becomes a far more cost-effective + choice. See a side-by-side{" "} + pricing estimate. +

+ + ), + }, + { + title: "Architecture and Deployment", + body: ( + <> +

+ Okta is a cloud-based service, so there is little infrastructure to set up. That enables + quick deployment and removes much of the DevOps burden. The trade-off is that enterprises + with strict regulatory or data-residency requirements often need on-premise options that a + SaaS-only model can't provide. +

+

+ Keycloak can be deployed on-premise, in your own cloud, + or via a managed cloud service. Because you control the + deployment environment, it conforms to compliance and data-sovereignty needs and gives you + greater control over security standards.{" "} + Winner: Depends. If you need on-premise or strict data control, Keycloak + wins clearly — and it still gives you the flexibility to{" "} + self-host or use managed hosting. +

+ + ), + }, + { + title: "Maintenance", + body: ( + <> +

+ A strong advantage of Okta is that it is a managed service. From a DevOps perspective, it + requires minimal maintenance — the Okta team handles updates, security patches, and + infrastructure, keeping the system up to date. This comes at a cost, though, since + customization of Okta is limited. +

+

+ Self-hosted Keycloak requires more attention: organizations must allocate resources for + installing, configuring, and updating the software, as well as managing the underlying + infrastructure. This can be a drawback for teams without the necessary technical expertise. + Phase Two removes this trade-off entirely: with{" "} + managed hosting and{" "} + zero-downtime upgrades, you get + Keycloak's control without the operational load.{" "} + Winner: Okta for self-hosted Keycloak; a tie when Keycloak is managed by Phase + Two. +

+ + ), + }, + { + title: "Functionality and Flexibility", + body: ( + <> +

+ Okta's authentication mechanisms support multiple methods for enhanced security and user + convenience. Its authorization capabilities include role-based access control (RBAC) and + policy management, and it supports identity federation through SAML, OpenID Connect, and + other standards. Single sign-on (SSO) ensures a seamless experience across applications, + and Okta's user management features include self-service registration, account recovery, + and a comprehensive directory. Okta also offers extensive APIs, pre-built integrations, + detailed analytics and logging, and automated lifecycle management for provisioning and + deprovisioning. +

+

+ Keycloak offers a comprehensive suite of features that is at parity with — or better than — + Okta in many ways. It provides multiple authentication methods, including + username/password, social logins, and multi-factor authentication (MFA). It supports + fine-grained authorization through RBAC and attribute-based access control (ABAC), excels + at identity federation via SAML and OpenID + Connect, and delivers SSO across multiple applications. Its user management covers + registration, password policies, and account linking, and the platform is highly + customizable through themes, custom code, and extensive configuration options, backed by + strong community support and a wide range of extensions. +

+

+ A key point: the features that Okta and Auth0 cover somewhat separately are all covered by + a single Keycloak deployment.{" "} + Winner: Keycloak. The two offer much of the same authentication and + authorization functionality, but Keycloak is extremely flexible to extend and configure — + a system that can adjust and grow with an application — and it centralizes more use cases + without distinctions between separate products. +

+ + ), + }, + { + title: "Integrating Keycloak with External Systems like Okta", + body: ( + <> +

+ For organizations looking to transition from Okta to Keycloak — or to integrate Keycloak + with systems already using Okta — Keycloak's flexibility offers significant advantages. + Keycloak can be configured to act as a broker that sits between Okta and your applications, + letting you leverage the strengths of both platforms. For example, an organization can use + Okta for external user management due to its robust third-party integrations while using + Keycloak to handle more sensitive internal authentication needs. +

+

+ Keycloak's identity brokering capability lets it delegate authentication to external + identity providers (IdPs) such as Okta. Keycloak can manage internal permissions and + roles, provide additional security checks, and maintain a consistent, user-friendly login + experience across systems. This makes migrating + off Okta a low-risk, phased process — you can move one piece at a time without + disrupting user access or security. +

+ + ), + }, + { + title: "Which IAM Solution Is Best for Me?", + body: ( + <> +

+ Choosing between Okta and Keycloak largely depends on your organization's specific needs + and capabilities. Okta is an excellent choice for those who need a fully managed solution + with costs linked to user numbers and features. For organizations that prioritize cost + savings and predictability, have the capability to manage their infrastructure, or require + extensive customization, Keycloak emerges as a powerful, budget-friendly alternative. Both + platforms offer extensive documentation and community support. +

+

+ Ultimately, we at Phase Two believe marrying the two together is the strongest match. We + offer robust Keycloak hosting,{" "} + migration, and support options that fit + businesses of multiple sizes. Coupling the capabilities of Keycloak with the advantages of + a managed service translates directly to implementation and cost control across SSO, + authentication, authorization, user management, and more.{" "} + Leveraging Keycloak means that ongoing costs are relatively fixed, since + concerns about user growth or feature needs don't have to factor into every decision. +

+ + ), + }, +]; + +const faqs = [ + { + q: "Is Keycloak a good alternative to Okta?", + a: ( +

+ Yes. Keycloak supports the same core standards as Okta (SAML, OpenID Connect, OAuth 2.0) and + matches it on most authentication and authorization features — SSO, MFA, federation, RBAC, + and user management — while being open source and free of per-user licensing. The main + trade-off is operational overhead, which a managed host like Phase Two removes. +

+ ), + text: + "Yes. Keycloak supports the same core standards as Okta (SAML, OpenID Connect, OAuth 2.0) and matches it on most authentication and authorization features — SSO, MFA, federation, RBAC, and user management — while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + }, + { + q: "Is Keycloak cheaper than Okta?", + a: ( +

+ For most growing organizations, yes. Okta pricing scales with the number of users and the + features you enable, and costs can balloon at enterprise scale. Keycloak's cost is driven by + hosting infrastructure and stays largely fixed as your user base grows, so teams moving from + Okta to managed Keycloak frequently see substantial savings. +

+ ), + text: + "For most growing organizations, yes. Okta pricing scales with the number of users and the features you enable, and costs can balloon at enterprise scale. Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows, so teams moving from Okta to managed Keycloak frequently see substantial savings.", + }, + { + q: "Can I migrate from Okta to Keycloak?", + a: ( +

+ Yes. Keycloak can act as a broker that delegates authentication to Okta during a phased + cutover, so you can migrate incrementally — using Okta for some flows while Keycloak handles + internal permissions and roles — without disrupting users. See{" "} + Migrate to Keycloak. +

+ ), + text: + "Yes. Keycloak can act as a broker that delegates authentication to Okta during a phased cutover, so you can migrate incrementally — using Okta for some flows while Keycloak handles internal permissions and roles — without disrupting users.", + }, + { + q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", + a: ( +

+ Yes. Keycloak is built on these standards and excels at identity federation, interoperating + with both modern applications and external identity providers — including Okta itself + through identity brokering. +

+ ), + text: + "Yes. Keycloak is built on these standards and excels at identity federation, interoperating with both modern applications and external identity providers — including Okta itself through identity brokering.", + }, + { + q: "Can Keycloak be self-hosted or run on-premise?", + a: ( +

+ Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This + flexibility is a key advantage over Okta's cloud-only model, especially for data-residency, + sovereignty, and compliance requirements. +

+ ), + text: + "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over Okta's cloud-only model, especially for data-residency, sovereignty, and compliance requirements.", + }, +]; + +export default function KeycloakVsOkta() { + return ( + + ); +} diff --git a/src/pages/keycloak-alternatives/onelogin.jsx b/src/pages/keycloak-alternatives/onelogin.jsx new file mode 100644 index 00000000..a5101f49 --- /dev/null +++ b/src/pages/keycloak-alternatives/onelogin.jsx @@ -0,0 +1,298 @@ +import Link from "@docusaurus/Link"; +import React from "react"; +import ComparisonLayout from "../../components/comparison/ComparisonLayout"; + +const meta = { + title: "Keycloak vs. OneLogin: The Open-Source Alternative", + description: + "An in-depth comparison of Keycloak vs. OneLogin — cost, deployment, customization, scalability, and support — and why Keycloak is a strong open-source alternative to OneLogin.", + keywords: + "keycloak vs onelogin, onelogin alternative, open source onelogin alternative, onelogin pricing, managed keycloak, workforce sso", +}; + +const heroIntro = ( + <> + OneLogin (by One Identity) is a commercial workforce SSO and access management platform; + Keycloak is the open-source alternative that competes strongly on cost, control, and + customization. Here's how the two compare across cost, deployment, customization, + scalability, functionality, and support — and why pairing Keycloak with a managed host like + Phase Two often gives you the best of both. + +); + +const atAGlance = [ + { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, + { dim: "Pricing driver", vendor: "Per user per month + feature tiers", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, + { dim: "Cost predictability", vendor: "Scales with users and advanced features; opaque enterprise pricing", keycloak: "Predictable; decoupled from user growth" }, + { dim: "Deployment", vendor: "Primarily cloud SaaS, some on-premise options", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, + { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML", keycloak: "OAuth 2.0, OIDC, SAML" }, + { dim: "Extensibility", vendor: "Customizable interface, bounded options", keycloak: "Full source access + SPIs/extensions" }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, +]; + +const sections = [ + { + title: "Cost Structure", + body: ( + <> +

+ As an open-source platform, Keycloak is free to use, making it a cost-effective option + for businesses of all sizes. There are no licensing fees; the trade-off is that you + manage your own hosting and infrastructure, which can incur costs depending on your + resource needs. +

+

+ OneLogin operates on a subscription model, with per-user-per-month pricing for its basic + services. Advanced features such as multi-factor authentication (MFA) require higher-tier + licenses, which can drive up costs — particularly for large enterprises with many users + that need advanced security features. Pricing beyond the basic tiers is opaque and + generally requires engaging OneLogin sales. +

+

+ Winner: Keycloak. It is more economically advantageous and transparent, + particularly for organizations equipped to manage their own hosting. You can leverage + Phase Two's hosting to test and integrate authentication and + authorization into your applications, and see a side-by-side{" "} + pricing estimate. +

+ + ), + }, + { + title: "Deployment and Maintenance", + body: ( + <> +

+ Keycloak supports on-premises and private cloud deployments. Organizations get full + control over configuration, but they also bear the responsibility for maintenance and + updates. +

+

+ OneLogin is primarily a cloud-based solution, though it also provides on-premises options. + Because it is managed by the vendor, organizations benefit from automatic updates and less + internal maintenance. +

+

+ Winner: OneLogin for self-hosted Keycloak — it simplifies deployment and reduces + maintenance for IT teams. That trade-off largely disappears with managed Keycloak: + Phase Two provides managed hosting and{" "} + zero-downtime upgrades, so you keep + Keycloak's control without the operational load — and you can still{" "} + self-host or use managed hosting as your + needs change. +

+ + ), + }, + { + title: "Customization and Branding", + body: ( + <> +

+ Keycloak allows extensive customization, enabling organizations to tailor authentication + workflows and user interfaces to specific needs. When unifying login from multiple systems + into a single one, Keycloak can adapt and support those requirements as necessary. This + level of customization may, however, require more technical expertise. +

+

+ OneLogin offers a customizable interface, but its options are more limited than Keycloak's. + It focuses on providing a unified experience without deep customization, and specific + business use-cases may not be supported. +

+

+ Winner: Keycloak. It wins on customization and flexibility; OneLogin + provides simplicity, but without the same ability to adapt to specific needs. +

+ + ), + }, + { + title: "Scalability and Performance", + body: ( + <> +

+ Keycloak is designed to scale efficiently, accommodating large user bases through + horizontal scaling and clustered deployments, which makes it suitable for extensive + enterprise environments. +

+

+ As a cloud solution, OneLogin is also scalable, but it is typically geared toward + medium-sized enterprises. It can handle multiple applications but may not perform optimally + under very high user loads. +

+

+ Winner: Both can scale, but Keycloak is the better choice for large-scale + applications requiring high concurrency and many user sessions. +

+ + ), + }, + { + title: "Functionality and Flexibility", + body: ( + <> +

+ Keycloak provides a comprehensive suite of features, including diverse authentication + methods, fine-grained access control, and strong identity federation capabilities + (OpenID Connect, OAuth 2.0, SAML 2.0). It allows for deeper integration with existing + systems. +

+

+ OneLogin is built on Ruby on Rails and includes essential features such as SSO and MFA, + using machine learning to assess user risk scores and enhance security. However, it may + not match Keycloak in offering a wide array of advanced features for complex IAM scenarios. +

+

+ Winner: Keycloak. It holds an advantage with its broader range of + functionality and its flexibility of integration. +

+ + ), + }, + { + title: "Integration Capabilities", + body: ( + <> +

+ Keycloak supports integration with various identity providers and protocols, enabling + flexible authentication across systems. It also has built-in support for many social + identity providers — such as Google, Twitter, Facebook, and Stack Overflow — which can be + configured in an advanced manner. +

+

+ OneLogin features a well-developed library of pre-built integrations for third-party + applications, providing a straightforward way to manage user access across systems. It also + integrates with HR systems and supports directory integrations, which can be particularly + useful for organizations relying on a variety of SaaS applications. +

+

+ Winner: It depends on your needs. OneLogin is easier for basic + integrations, while Keycloak offers greater versatility for complex requirements. +

+ + ), + }, + { + title: "Community and Support", + body: ( + <> +

+ Keycloak has a supportive open-source community, with extensive documentation and user + forums for troubleshooting and guidance. Phase Two offers{" "} + enterprise support for hosted and on-prem customers, as well as + for those running their own Keycloak deployment. +

+

+ OneLogin provides dedicated customer support, along with comprehensive documentation and + professional services for additional assistance. +

+

+ Winner: It depends. Keycloak's community offers robust support for users, + while OneLogin provides more direct, vendor-driven help. +

+ + ), + }, + { + title: "Which one is best for me?", + body: ( + <> +

+ When selecting an IAM solution, it's essential to evaluate your organization's specific + needs. Keycloak is ideal for those seeking an open-source, highly customizable platform + that can scale to meet complex requirements. OneLogin, by contrast, is well-suited for + enterprises looking for an easy-to-use, managed service with a focus on integrations. As an + implementation grows in size, however, the cost can become too high to entertain. +

+

+ Working with Phase Two provides some of the best of both worlds: easy integration with the + ability to scale without incurring additional per-user costs. If you're looking to{" "} + migrate to Keycloak, or have questions + about Phase Two's enterprise support, you can also explore{" "} + on-premise deployment options. +

+ + ), + }, +]; + +const faqs = [ + { + q: "Is Keycloak a good alternative to OneLogin?", + a: ( +

+ Yes. Keycloak supports the same core standards as OneLogin (OAuth 2.0, OpenID Connect, SAML) + and offers a comprehensive set of authentication and authorization features, while being open + source and free of per-user licensing. The main trade-off is operational overhead, which a + managed host like Phase Two removes. +

+ ), + text: + "Yes. Keycloak supports the same core standards as OneLogin (OAuth 2.0, OpenID Connect, SAML) and offers a comprehensive set of features, while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + }, + { + q: "Is Keycloak cheaper than OneLogin?", + a: ( +

+ For most growing organizations, yes. OneLogin pricing is per user per month and climbs with + advanced features such as MFA, while Keycloak's cost is driven by hosting infrastructure and + stays largely fixed as your user base grows. As implementations scale, OneLogin's per-user + model can become significantly more expensive than running Keycloak. +

+ ), + text: + "For most growing organizations, yes. OneLogin pricing is per user per month and climbs with advanced features such as MFA, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows.", + }, + { + q: "Can I migrate from OneLogin to Keycloak?", + a: ( +

+ Yes. Keycloak can import your users and broker authentication during a phased cutover, so you + can migrate incrementally without disrupting access. See{" "} + Migrate to Keycloak. +

+ ), + text: + "Yes. Keycloak can import your users and broker authentication during a phased cutover, so you can migrate incrementally without disrupting access.", + }, + { + q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", + a: ( +

+ Yes. Keycloak is built on these standards and provides strong identity federation, with + built-in support for many social identity providers and integration with existing systems + such as LDAP and Active Directory. +

+ ), + text: + "Yes. Keycloak is built on these standards and provides strong identity federation, with built-in support for many social identity providers and integration with existing systems such as LDAP and Active Directory.", + }, + { + q: "Can Keycloak be self-hosted or run on-premise?", + a: ( +

+ Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This + flexibility gives you full control over configuration, data residency, and compliance — an + advantage over a primarily cloud-based model. See{" "} + on-premise deployment. +

+ ), + text: + "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility gives you full control over configuration, data residency, and compliance.", + }, +]; + +export default function KeycloakVsOneLogin() { + return ( + + ); +} diff --git a/src/pages/keycloak-alternatives/ping-identity.jsx b/src/pages/keycloak-alternatives/ping-identity.jsx new file mode 100644 index 00000000..64a88c59 --- /dev/null +++ b/src/pages/keycloak-alternatives/ping-identity.jsx @@ -0,0 +1,338 @@ +import Link from "@docusaurus/Link"; +import React from "react"; +import ComparisonLayout from "../../components/comparison/ComparisonLayout"; + +const meta = { + title: "Keycloak vs. Ping Identity: The Open-Source Alternative", + description: + "An in-depth comparison of Keycloak vs. Ping Identity — deployment, customization, pricing, scalability, and features — and why Keycloak is a strong open-source alternative to Ping Identity.", + keywords: + "keycloak vs ping identity, ping identity alternative, open source ping identity alternative, ping identity pricing, managed keycloak", +}; + +const heroIntro = ( + <> + Ping Identity is an established commercial IAM platform built for large + enterprises; Keycloak is the open-source alternative that competes strongly + on customization, cost, and flexibility. Here's how the two compare across + deployment, pricing, scalability, and features — and why pairing Keycloak + with a managed host like Phase Two often gives you enterprise capability + without the enterprise license. + +); + +const atAGlance = [ + { dim: "Licensing model", vendor: "Proprietary, commercial license", keycloak: "Open source (Apache 2.0), no license fee" }, + { dim: "Pricing driver", vendor: "User count + features", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, + { dim: "Cost predictability", vendor: "Scales with users and features; can climb steeply at large deployments", keycloak: "Predictable; decoupled from user growth" }, + { dim: "Deployment", vendor: "Hybrid — cloud-based and on-premises", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, + { dim: "Data residency / sovereignty", vendor: "Strong control via hybrid/on-prem options", keycloak: "Full control over environment and data location" }, + { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML", keycloak: "OAuth 2.0, OIDC, SAML" }, + { dim: "Extensibility", vendor: "Configurable, but customization takes more effort", keycloak: "Full source access + SPIs/extensions" }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, +]; + +const sections = [ + { + title: "Deployment Model", + body: ( + <> +

+ Keycloak is an open-source IAM solution that can be deployed both{" "} + on-premise and in cloud + environments. This flexibility lets organizations choose their + preferred hosting option while maintaining control over their identity + management infrastructure. Its ability to adapt quickly to new + standards makes it particularly suitable for agile development + environments. +

+

+ Ping Identity offers a hybrid deployment model that combines both + cloud-based and on-premises options. This versatility is particularly + beneficial for large enterprises where regulatory compliance dictates + specific control over identity services. +

+

+ + Winner: Tie. + {" "} + Both solutions offer strong options for those who need to deploy the + way they want to. Both provide enterprise-centric hybrid options that + accommodate complex infrastructure needs — and with Keycloak you can{" "} + + self-host or use managed hosting + {" "} + without changing platforms. +

+ + ), + }, + { + title: "Customization and Flexibility", + body: ( + <> +

+ Keycloak shines with its extensive customization features, allowing + developers to modify everything from login pages to role-based access + controls. Being open-source software, organizations have the freedom + to make adjustments at any time without vendor lock-in, making it a + powerful and cost-effective solution. It can be used as a standalone + solution or integrated as an element of a broader IT infrastructure. +

+

+ Ping Identity also offers customization capabilities, but often + demands more technical effort to implement tailored solutions. While + it is configurable, achieving significant customizations may be more + challenging compared to Keycloak. +

+

+ Winner: Keycloak for its superior flexibility and + ease of customization, particularly appealing to developers. +

+ + ), + }, + { + title: "User Experience and Ease of Use", + body: ( + <> +

+ Keycloak is designed with usability in mind, featuring an intuitive + interface and a straightforward setup process. Its fast, agile nature + allows it to adapt quickly to changing application landscapes, + ensuring accessibility for users. It supports Single Sign-On (SSO), + identity brokering, and various protocols (OAuth 2.0, OpenID Connect, + SAML), streamlining the user experience. +

+

+ Ping Identity prioritizes a comprehensive user experience targeting + both technical and non-technical users. Although it features a polished + interface, the initial setup can be complex, resulting in a steeper + learning curve for administrators. +

+

+ Winner: Keycloak edges out in user-friendliness + during initial setup and usability. +

+ + ), + }, + { + title: "Scalability and Performance", + body: ( + <> +

+ With its cloud-native adaptation and support for high-volume user + bases, Keycloak scales effectively to meet organizational needs. + However, managing a scaled Keycloak system can require significant + time and resources without{" "} + proper enterprise support. +

+

+ Ping Identity is designed for large-scale environments with robust + scalability features, ensuring seamless performance under heavy loads, + making it particularly suited for large organizations. +

+

+ Winner: Ping Identity excels in scalability and + performance, proving its capability to manage large-scale + authentication requests. However, this comes at a larger cost, which + could be offset by taking on the management of Keycloak. +

+ + ), + }, + { + title: "Pricing Model", + body: ( + <> +

+ Being open-source software, Keycloak has no licensing fees, making it + highly cost-effective. Organizations should, however, consider + potential indirect costs related to deployment and system management. +

+

+ Ping Identity operates on a traditional licensing model based on user + count and features, which can lead to higher costs, particularly for + larger deployments. +

+

+ Winner: Keycloak is the clear winner for pricing, + offering a more budget-friendly option. Coupled with a cost-conscious + hosting provider, this can save an organization substantially over the + course of an implementation. See a side-by-side{" "} + hosting pricing estimate. +

+ + ), + }, + { + title: "Integration Ecosystem", + body: ( + <> +

+ Keycloak provides a strong API and a powerful admin portal, making it + compatible with a wide range of frameworks like Spring Boot, Django, + React, and more. Its supportive community contributes extensions and + integrations alongside continuous improvements, enhancing its + adaptability. +

+

+ Ping Identity features a curated integration ecosystem focused on + enterprise-level applications, providing documentation and support for + integrations, but it may lack the range of community-driven options + available with Keycloak. +

+

+ Winner: Keycloak takes the lead for its extensive + integration options and supportive community. Leverage Phase Two's{" "} + hosting to test and integrate + authentication and authorization into your applications. +

+ + ), + }, + { + title: "Advanced Features", + body: ( + <> +

+ Keycloak supports fine-grained authorization and customizable themes, + making it a flexible and cost-effective solution for diverse security + needs. Its rapid adaptability to new technologies helps organizations + stay relevant in a changing landscape. +

+

+ Ping Identity excels with advanced features such as fraud detection, + identity verification, and robust orchestration capabilities, + positioning it as a strong choice for larger enterprises requiring + comprehensive security and compliance. +

+

+ Winner: Tie. Both Keycloak and Ping Identity offer + valuable advanced features — Keycloak provides flexibility for diverse + environments, while Ping Identity delivers robust security measures + suited to complex enterprise needs. +

+ + ), + }, + { + title: "Which one is best for me?", + body: ( + <> +

+ Both Keycloak and Ping Identity provide essential IAM capabilities, + but their strengths cater to different organizational needs. Keycloak + excels in customization, user experience, cost-effectiveness, and + flexibility, making it ideal for organizations prioritizing quick + adaptation and flexibility. In contrast, Ping Identity stands out with + its hybrid deployment capabilities, scalability, and advanced security + functionality, positioning it as a strong choice for larger + enterprises. Ultimately, the decision should align with the specific + requirements, resources, and strategic goals of your organization. +

+

+ If you're looking to{" "} + migrate to Keycloak, or + have questions about Phase Two's{" "} + enterprise support, please{" "} + + contact us + + . +

+ + ), + }, +]; + +const faqs = [ + { + q: "Is Keycloak a good alternative to Ping Identity?", + a: ( +

+ Yes. Keycloak supports the same core standards as Ping Identity (OAuth + 2.0, OpenID Connect, SAML) and matches it on most authentication and + authorization features, while being open source and free of per-user + licensing. It is especially compelling for teams that value + customization and flexibility. The main trade-off is operational + overhead, which a managed host like Phase Two removes. +

+ ), + text: + "Yes. Keycloak supports the same core standards as Ping Identity (OAuth 2.0, OpenID Connect, SAML) and matches it on most features, while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + }, + { + q: "Is Keycloak cheaper than Ping Identity?", + a: ( +

+ For most deployments, yes. Ping Identity is licensed based on user count + and features, which can climb steeply for larger deployments, while + Keycloak has no license fee and its cost is driven primarily by hosting + infrastructure, staying largely fixed as your user base grows. Paired + with a cost-conscious host, this can save an organization substantially + over the course of an implementation. +

+ ), + text: + "For most deployments, yes. Ping Identity is licensed based on user count and features, while Keycloak has no license fee and its cost is driven primarily by hosting infrastructure, staying largely fixed as your user base grows.", + }, + { + q: "Can Keycloak and Ping Identity both be deployed on-premise?", + a: ( +

+ Yes. Ping Identity offers a hybrid model combining cloud-based and + on-premises options, and Keycloak can run{" "} + on-premise, in your own cloud, or as a + managed service. Both are strong choices when regulatory compliance and + data sovereignty require control over where identity services run. +

+ ), + text: + "Yes. Ping Identity offers a hybrid model combining cloud-based and on-premises options, and Keycloak can run on-premise, in your own cloud, or as a managed service. Both are strong choices when compliance requires control over where identity services run.", + }, + { + q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", + a: ( +

+ Yes. Keycloak is built on these standards and supports Single Sign-On + (SSO) and identity brokering, interoperating with both modern + applications and frameworks like Spring Boot, Django, and React. +

+ ), + text: + "Yes. Keycloak is built on these standards and supports Single Sign-On (SSO) and identity brokering, interoperating with modern applications and frameworks like Spring Boot, Django, and React.", + }, + { + q: "Can I migrate from Ping Identity to Keycloak?", + a: ( +

+ Yes. Keycloak can import users and broker authentication during a phased + cutover, so you can migrate incrementally without disrupting access. See{" "} + Migrate to Keycloak, or + ask about Phase Two's enterprise support. +

+ ), + text: + "Yes. Keycloak can import users and broker authentication during a phased cutover, so you can migrate incrementally without disrupting access.", + }, +]; + +export default function KeycloakVsPingIdentity() { + return ( + + ); +} diff --git a/src/pages/keycloak-alternatives/workos.jsx b/src/pages/keycloak-alternatives/workos.jsx new file mode 100644 index 00000000..657b3864 --- /dev/null +++ b/src/pages/keycloak-alternatives/workos.jsx @@ -0,0 +1,331 @@ +import Link from "@docusaurus/Link"; +import React from "react"; +import ComparisonLayout from "../../components/comparison/ComparisonLayout"; + +const meta = { + title: "Keycloak vs. WorkOS: The Open-Source Alternative", + description: + "An in-depth comparison of Keycloak vs. WorkOS — cost of ownership, deployment, customization, scalability, and features — and why managed Keycloak is a strong open-source alternative to WorkOS.", + keywords: + "keycloak vs workos, workos alternative, open source workos alternative, workos pricing, managed keycloak, workos sso", +}; + +const heroIntro = ( + <> + WorkOS is a closed-source, fully managed platform built to add SSO to an application quickly; + Keycloak is the open-source alternative that competes strongly on cost, control, and + extensibility. Here's how the two compare across cost of ownership, deployment, customization, + scalability, and features — and why pairing Keycloak with a managed host like Phase Two often + gives you the best of both. + +); + +const atAGlance = [ + { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, + { dim: "Pricing driver", vendor: "Per monthly active user + per-feature (SSO, SCIM, audit logs, custom domains)", keycloak: "Fixed infrastructure / hosting cost, not per-user or per-feature" }, + { dim: "Cost predictability", vendor: "Scales with users, connections, and features", keycloak: "Predictable; decoupled from user growth and feature gates" }, + { dim: "Deployment", vendor: "Cloud SaaS only, hosted by WorkOS", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, + { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML, SCIM", keycloak: "OAuth 2.0, OIDC, SAML, SCIM, LDAP" }, + { dim: "Extensibility", vendor: "Unified API, bounded customization", keycloak: "Full source access + SPIs/extensions" }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, +]; + +const sections = [ + { + title: "Cost of Ownership", + body: ( + <> +

+ WorkOS operates on a subscription-based model, where pricing is tied to the number of + monthly active users. While a large block of users is included at the base tier, WorkOS + charges separately for capabilities like custom domains, SSO connections, SCIM + provisioning, and audit logs. The more enterprise customers you onboard, the more your + costs grow — and with every feature enabled, the per-user cost climbs, so bills can rise + quickly and become a significant piece of overall IT spend. +

+

+ Keycloak, by contrast, is open source and free to use regardless of users or scale. The + primary cost is the infrastructure to host and operate the software. Because cost isn't + driven by features, connections, or user counts, your spend tends to be{" "} + fixed — a far more predictable model when you're bringing multiple + applications together, since adding connections doesn't increase your bill. The biggest + cost factor becomes the scale of the infrastructure you need. +

+

+ Winner: Keycloak. With the right hosting solution, Keycloak is a far + more cost-effective choice, freeing organizations to allocate funds elsewhere. Compare a{" "} + side-by-side pricing estimate, or start on{" "} + Phase Two's hosting to test and integrate authentication and + authorization into your applications. +

+ + ), + }, + { + title: "Deployment and Maintenance", + body: ( + <> +

+ WorkOS is a cloud-based identity platform that is hosted and managed by WorkOS. It offers + a simpler deployment process because there's no infrastructure to set up or maintain, and + organizations benefit from reduced internal IT burden since WorkOS handles updates, + security patches, and system maintenance. +

+

+ Keycloak can be deployed on-premise or in a private cloud, giving you complete control + over the infrastructure and the ability to customize and integrate with existing systems. + With support for Docker, Kubernetes, and other containerization technologies, it slots + into existing environments and workflows. The trade-off with self-hosting is that + organizations must allocate resources to install, configure, update, and operate the + underlying infrastructure. Phase Two removes that trade-off with{" "} + managed hosting and{" "} + zero-downtime upgrades, so you keep + Keycloak's control without the operational load. +

+

+ Winner: WorkOS for a fully hands-off managed service; a tie when Keycloak is + managed by Phase Two. If you need on-premise or strict data control, Keycloak + wins clearly — and it still lets you{" "} + self-host or use managed hosting. +

+ + ), + }, + { + title: "Customization and Branding", + body: ( + <> +

+ Keycloak offers unparalleled customization and extensibility — from authentication flows + and user federation to role-based access control (RBAC) and fine-grained permissions — + letting organizations tailor the user experience, login screens, and authentication + process to their specific needs. That level of control does require learning the + capabilities of Keycloak. +

+

+ WorkOS offers more limited customization options and focuses on providing a unified user + experience across different identity providers. We tip our hats to WorkOS for the + excellent job they've done on design and user experience. +

+

+ Winner: Keycloak, by a nose. Keycloak offers complete control over the + look and feel of the authentication and authorization process, while WorkOS does a strong + job of simplifying and constraining the problem for quick implementation. +

+ + ), + }, + { + title: "Scalability and Performance", + body: ( + <> +

+ With its robust architecture, Keycloak is designed to handle large-scale user bases, + making it an ideal choice for enterprises. It can be scaled horizontally by adding more + instances or running in clustered mode, ensuring high performance and reliability. + Keycloak is a great platform to unify on for companies with a growing number of + applications that have each taken their own approach to IAM. +

+

+ WorkOS offers scalable infrastructure, but it's better suited to small- and medium-sized + applications with moderate-to-high traffic. Its architecture is optimized for efficient + performance but may be less well-equipped for extremely high user-traffic volumes or a + rapidly growing number of connected enterprises. It tends to be stronger when working with + a specific application rather than connecting many applications together. +

+

+ Winner: Depends. Keycloak is a strong contender for large-scale + applications looking to scale, while WorkOS may deliver strong performance for small- and + medium-sized apps. +

+ + ), + }, + { + title: "Functionality and Flexibility", + body: ( + <> +

+ Keycloak offers a comprehensive suite of features for modern applications. It provides + secure authentication methods — including username/password, social logins, and MFA — as + well as fine-grained authorization through RBAC and ABAC. Keycloak excels at identity + federation with support for SAML and OpenID Connect, and its SSO feature offers a seamless + experience across applications. It also provides robust user management, customization, + self-registration, and active community support. For any missing functionality,{" "} + extensions can be written and deployed, allowing Keycloak to bend and mold to the + needs of its developers. +

+

+ WorkOS offers robust authentication and authorization capabilities, including role-based + access control, policy management, and support for multiple identity standards. Its single + sign-on feature provides a seamless experience across apps and services, and it includes + self-service registration, account recovery, and a comprehensive user directory. + Integration with third-party apps is simplified through APIs and pre-built integrations, + while analytics and logging tools help with monitoring and compliance. +

+

+ Winner: Keycloak. Both platforms offer robust functionality, but + Keycloak's advanced identity federation, fine-grained authorization controls, and ability + to customize and extend give it an edge. +

+ + ), + }, + { + title: "Integration Capabilities", + body: ( + <> +

+ Keycloak's identity brokering capability lets you delegate authentication to external + identity providers, applications, and protocols such as LDAP, SAML, OAuth, and OpenID + Connect. Managing internal permissions and roles, security checks, and login experiences + across different systems can be done seamlessly. +

+

+ WorkOS has a narrower focus on authentication, but it provides a uniform API for + integrating with popular identity providers like Google, Microsoft, and Okta. That unified + interface reduces complexity and development time. +

+

+ If you're switching from WorkOS, Keycloak can be configured to act as a broker that sits + between WorkOS and your applications, letting you leverage the strengths of both. For + example, WorkOS can handle external user management while Keycloak handles more sensitive, + internal authentication needs.{" "} + Winner: Keycloak is the most versatile choice for organizations with + complex requirements. +

+ + ), + }, + { + title: "Community and Support", + body: ( + <> +

+ Keycloak has a large and active community of developers and contributors, ensuring + continuous development, bug fixes, and updates. It has extensive documentation, forums, + and{" "} + + community support channels + {" "} + where users can seek help and share knowledge. WorkOS also provides support but may have + limitations in terms of community contributions and public resources; it offers dedicated + support channels and resources for assistance and issue resolution. +

+

+ Working with Phase Two gives you some of the best of both worlds: easy integration with + the ability to scale without incurring additional costs. If you have questions about Phase + Two's enterprise support, we're happy to help. +

+ + ), + }, + { + title: "Migrating from WorkOS to Keycloak", + body: ( + <> +

+ Moving off WorkOS is more approachable than many teams expect. Keycloak imports users, + supports gradual cutover, and brokers identities so you can transition without disrupting + access — see Migrate to Keycloak. +

+

+ You can also run Keycloak alongside WorkOS during a transition: Keycloak can act + as a broker that sits between WorkOS and your applications. That lets you keep existing + WorkOS connections — for example, for external user management — while Keycloak handles + internal permissions, roles, and a consistent login experience. It's a low-risk path to + migrating one piece at a time. For teams with strict requirements, Keycloak's{" "} + on-premise deployment options are a standout advantage + over a cloud-only platform. +

+ + ), + }, +]; + +const faqs = [ + { + q: "Is Keycloak a good alternative to WorkOS?", + a: ( +

+ Yes. Keycloak supports the same core standards as WorkOS (OAuth 2.0, OpenID Connect, SAML, + and SCIM) and matches it on most authentication and authorization features, while being open + source and free of per-user, per-connection licensing. It also offers far greater + customization and extensibility. The main trade-off is operational overhead, which a managed + host like Phase Two removes. +

+ ), + text: + "Yes. Keycloak supports the same core standards as WorkOS (OAuth 2.0, OpenID Connect, SAML, and SCIM) and matches it on most features, while being open source and free of per-user, per-connection licensing. It also offers far greater customization and extensibility. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + }, + { + q: "Is Keycloak cheaper than WorkOS?", + a: ( +

+ For most growing applications, yes. WorkOS pricing scales with monthly active users and + adds per-feature charges for things like SSO connections, SCIM, custom domains, and audit + logs, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as + your user base and connections grow. Because cost isn't tied to features or users, the + ongoing spend is predictable. +

+ ), + text: + "For most growing applications, yes. WorkOS pricing scales with monthly active users and adds per-feature charges for SSO connections, SCIM, custom domains, and audit logs, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base and connections grow.", + }, + { + q: "Can I migrate from WorkOS to Keycloak?", + a: ( +

+ Yes. Keycloak can import your users and broker authentication to WorkOS during a phased + cutover, so you can migrate incrementally without disrupting users. You can even run + Keycloak as a broker in front of WorkOS to leverage both platforms during the transition. + See Migrate to Keycloak. +

+ ), + text: + "Yes. Keycloak can import your users and broker authentication to WorkOS during a phased cutover, so you can migrate incrementally without disrupting users. You can even run Keycloak as a broker in front of WorkOS during the transition.", + }, + { + q: "Does Keycloak support SAML, OIDC, OAuth 2.0, and SCIM?", + a: ( +

+ Yes. Keycloak is built on these standards and interoperates with both modern applications + and legacy systems, including LDAP and Active Directory. Its identity brokering lets you + delegate authentication to external identity providers like Google, Microsoft, and Okta. +

+ ), + text: + "Yes. Keycloak is built on these standards and interoperates with both modern applications and legacy systems, including LDAP and Active Directory. Its identity brokering lets you delegate authentication to external identity providers like Google, Microsoft, and Okta.", + }, + { + q: "Can Keycloak be self-hosted or run on-premise?", + a: ( +

+ Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This + flexibility is a key advantage over WorkOS's cloud-only model, especially for data-residency + and compliance requirements. +

+ ), + text: + "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over WorkOS's cloud-only model, especially for data-residency and compliance requirements.", + }, +]; + +export default function KeycloakVsWorkOS() { + return ( + + ); +} diff --git a/src/pages/product/open-source-vs-commercial-offering.jsx b/src/pages/product/open-source-vs-commercial-offering.jsx index 5a624806..f81cb8ca 100644 --- a/src/pages/product/open-source-vs-commercial-offering.jsx +++ b/src/pages/product/open-source-vs-commercial-offering.jsx @@ -4,6 +4,7 @@ import React from "react"; import CardWithIcon from "../../components/CardWithIcon"; import CardWithImage from "../../components/CardWithImage"; import Cta from "../../components/ctas/homepage-dual-line-cta"; +import CompareKeycloakBlock from "../../components/CompareKeycloakBlock"; import IconQuestionMarkCircle from "@site/static/img/icon-question-mark-circle.svg"; const HERO_IMG = "/img/hero-opensource-vs-commercial.svg"; @@ -212,6 +213,13 @@ export default function OpenSourceVsCommercialOffering() { + {/* Compare to commercial IAM vendors */} +
+
+ +
+
+ {/* CTA */} Date: Wed, 1 Jul 2026 13:08:35 -0600 Subject: [PATCH 2/3] create specific versus pages --- docusaurus.config.js | 7 + .../comparison/ComparisonLayout.jsx | 523 +++++-- src/components/comparison/Icon.jsx | 48 + src/css/comparison.css | 1339 +++++++++++++++++ src/css/custom.css | 1 + src/pages/keycloak-alternatives.jsx | 418 ++--- src/pages/keycloak-alternatives/auth0.jsx | 306 ++-- src/pages/keycloak-alternatives/frontegg.jsx | 365 ++--- src/pages/keycloak-alternatives/okta.jsx | 319 ++-- src/pages/keycloak-alternatives/onelogin.jsx | 340 ++--- .../keycloak-alternatives/ping-identity.jsx | 382 ++--- src/pages/keycloak-alternatives/workos.jsx | 370 ++--- .../img/comparison/logo_phase_slash_white.svg | 16 + static/img/comparison/phasetwo_logo_icon.svg | 10 + 14 files changed, 2662 insertions(+), 1782 deletions(-) create mode 100644 src/components/comparison/Icon.jsx create mode 100644 src/css/comparison.css create mode 100644 static/img/comparison/logo_phase_slash_white.svg create mode 100644 static/img/comparison/phasetwo_logo_icon.svg diff --git a/docusaurus.config.js b/docusaurus.config.js index 0f899f21..147f2058 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -49,6 +49,13 @@ module.exports = { href: "https://fonts.googleapis.com/css2?family=Manrope:wght@400;500&display=swap", }, }, + { + tagName: "link", + attributes: { + rel: "stylesheet", + href: "https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap", + }, + }, { tagName: "link", attributes: { diff --git a/src/components/comparison/ComparisonLayout.jsx b/src/components/comparison/ComparisonLayout.jsx index ce10f324..57ca7042 100644 --- a/src/components/comparison/ComparisonLayout.jsx +++ b/src/components/comparison/ComparisonLayout.jsx @@ -1,36 +1,259 @@ import Head from "@docusaurus/Head"; import Link from "@docusaurus/Link"; +import useDocusaurusContext from "@docusaurus/useDocusaurusContext"; import Layout from "@theme/Layout"; -import React from "react"; -import Cta from "../ctas/homepage-dual-line-cta"; -import CompareKeycloakBlock from "../CompareKeycloakBlock"; +import React, { useState } from "react"; +import DemoModal from "../DemoModal"; +import Icon from "./Icon"; -const HERO_IMG = "/img/hero-opensource-vs-commercial.svg"; const SITE = "https://phasetwo.io"; +const DASH = "https://dash.phasetwo.io/"; + +const VENDOR_LINKS = [ + { key: "auth0", label: "vs. Auth0", to: "/keycloak-alternatives/auth0/" }, + { key: "okta", label: "vs. Okta", to: "/keycloak-alternatives/okta/" }, + { key: "workos", label: "vs. WorkOS", to: "/keycloak-alternatives/workos/" }, + { key: "ping-identity", label: "vs. Ping Identity", to: "/keycloak-alternatives/ping-identity/" }, + { key: "frontegg", label: "vs. FrontEgg", to: "/keycloak-alternatives/frontegg/" }, + { key: "onelogin", label: "vs. OneLogin", to: "/keycloak-alternatives/onelogin/" }, +]; + +// Render a feature-matrix cell from a compact value: +// 'yes' | 'no' | 'lim' | '$$$' (or any "$" string) | {label, red} +function Cell({ cell }) { + if (cell === "yes") return ; + if (cell === "no") return ; + if (cell === "lim") return ; + if (cell && typeof cell === "object") { + const style = cell.red ? { background: "rgba(239,68,68,0.12)", color: "#EF4444" } : undefined; + return {cell.label}; + } + return {cell}; +} + +function CmpCard({ vendor, rows, mini }) { + return ( +
+
+
{mini ? "At a glance" : "Feature & cost comparison"}
+ {mini ? Full table → : null} +
+ + + + + + + + + + {rows.map((r) => ( + + + + + + ))} + +
{vendor}You
Keycloak{mini ? "" : " + Phase Two"}
{r.feat}
+
+ ); +} + +function Hero({ vendor, hero, slug }) { + const primary = hero.primaryCta || { label: "Try for Free", href: DASH }; + const secondary = hero.secondaryCta; + const logo = `/customer-logos/${slug}.svg`; + const PrimaryBtn = ( + + + + ); + const SecondaryBtn = secondary ? ( + {secondary.label} + ) : null; + const backlink = ( + All Keycloak alternatives + ); + + if (hero.variant === "A") { + return ( +
+
+
+
+ {backlink} +
+
+ + + + Keycloak +
+ VS +
{vendor}
+
+

{hero.headline}

+

{hero.lede}

+
{PrimaryBtn}{SecondaryBtn}
+ {hero.savingsPill ? ( +
{hero.savingsPill}
+ ) : null} +
+
+
+ ); + } + + if (hero.variant === "B") { + const miniRows = hero.miniRows || []; + return ( +
+
+
+
+ {backlink} +
+
+ {vendor} +
Keycloak vs. {vendor}
+

{hero.headline}

+

{hero.lede}

+
{PrimaryBtn}{SecondaryBtn}
+
+
Open-source parity with
+
OktaAuth0PingWorkOSOneLogin
+
+
+
+
+
+
+
+ ); + } + + // Variant C — headline + illustrative cost-curve chart + const chart = hero.chart || {}; + const xl = chart.xLabels || ["1k", "10k", "50k users"]; + return ( +
+
+
+
+ {backlink} +
+
+ {vendor} +
Keycloak vs. {vendor}
+

{hero.headline}

+

{hero.lede}

+
{PrimaryBtn}{SecondaryBtn}
+
+
+
{chart.title || "Annual identity spend vs. monthly active users"}
illustrative
+ + + + + + + + + + + $0$250k$500k + {xl[0]}{xl[1]}{xl[2]} + + +
+ {chart.legendVendor || vendor} + Keycloak + Phase Two (fixed) +
+
+
+
+
+
+ ); +} + +function DuoSection({ onContact }) { + return ( +
+
+
+
How we deliver
+

Two ways to run Keycloak with Phase Two

+
+
+
+
+
Managed Hosting
+

Managed Keycloak Hosting

+

Multi-region, high-availability Keycloak with 100+ extensions. Simple, cost-conscious, and customizable.

+
    +
  • Up to 10,000+ concurrent users
    • +
  • 99.99% uptime SLA & SOC 2
    • +
  • Custom domains & branding
    • +
  • Dedicated or shared clusters
    • +
+
+ + Learn more +
+
+
+
+
Enterprise Support
+

Enterprise Keycloak Support

+

Run your own Keycloak? Get expert escalation, security patches, and architecture guidance — at any level of complexity.

+
    +
  • 24/7 escalation with named engineers
    • +
  • Security advisories & patch backports
    • +
  • Architecture & migration reviews
    • +
  • Dedicated Slack channel
    • +
+
+ + Learn more +
+
+
+
+
+ ); +} -/** - * Shared layout for the per-vendor "Keycloak vs. X" comparison pages under - * /keycloak-alternatives//. Content-driven so every page stays consistent. - * - * Props: - * - vendor: display name, e.g. "Auth0" - * - slug: url + cross-link key, e.g. "auth0" - * - meta: { title, description, keywords } - * - heroIntro: JSX paragraph under the H1 - * - atAGlance: [{ dim, vendor, keycloak }] rows for the at-a-glance table - * - sections: [{ title, body }] prose sections (body is JSX) - * - faqs: [{ q, a, text }] (a = JSX answer, text = plain-text for JSON-LD) - */ export default function ComparisonLayout({ vendor, slug, + accent = "magenta", meta, - heroIntro, + hero, atAGlance = [], sections = [], + matrix, faqs = [], + migration, + bigcta, }) { + const { siteConfig: { customFields = {} } = {} } = useDocusaurusContext(); + const demoRequestEndpoint = + typeof customFields.demoRequestEndpoint === "string" + ? customFields.demoRequestEndpoint + : undefined; + const turnstileSiteKey = + typeof customFields.turnstileSiteKey === "string" + ? customFields.turnstileSiteKey + : undefined; + const [modalOpen, setModalOpen] = useState(false); + const openModal = () => setModalOpen(true); + const url = `${SITE}/keycloak-alternatives/${slug}/`; + const splitAt = Math.min(3, sections.length); + const before = sections.slice(0, splitAt); + const after = sections.slice(splitAt); const faqJsonLd = { "@context": "https://schema.org", @@ -41,27 +264,30 @@ export default function ComparisonLayout({ acceptedAnswer: { "@type": "Answer", text: f.text }, })), }; - const breadcrumbJsonLd = { "@context": "https://schema.org", "@type": "BreadcrumbList", itemListElement: [ { "@type": "ListItem", position: 1, name: "Home", item: `${SITE}/` }, - { - "@type": "ListItem", - position: 2, - name: "Keycloak Alternatives", - item: `${SITE}/keycloak-alternatives/`, - }, - { - "@type": "ListItem", - position: 3, - name: `Keycloak vs. ${vendor}`, - item: url, - }, + { "@type": "ListItem", position: 2, name: "Keycloak Alternatives", item: `${SITE}/keycloak-alternatives/` }, + { "@type": "ListItem", position: 3, name: `Keycloak vs. ${vendor}`, item: url }, ], }; + const ContentSection = ({ s, alt }) => ( +
+
+
+
+ {s.kicker} +

{s.title}

+
+
{s.body}
+
+
+
+ ); + return ( @@ -71,139 +297,101 @@ export default function ComparisonLayout({ - {faqs.length ? ( - - ) : null} + {faqs.length ? : null} -
- {/* Hero */} -
-
-
-
-
- -
+
+ -

- - ← All Keycloak alternatives - -

-

Keycloak vs. {vendor}

-

{heroIntro}

- -
- - - - - See the comparison - -
-
+ {/* At a glance */} +
+
+
+
The short version
+

Keycloak vs. {vendor} at a glance

+ + + + {atAGlance.map((r) => ( + + + + + + ))} + +
Dimension{vendor}Keycloak (with Phase Two)
{r.dim}{r.vendor}{r.check ? ✓ : null}{r.keycloak}
- {/* At a glance */} - {atAGlance.length ? ( -
-
-
-

- Keycloak vs. {vendor} at a glance -

+ {before.map((s, i) => )} + + {/* Feature matrix */} + {matrix ? ( +
+
+
+
The receipts
+

See it side-by-side

+

What you actually get for what you actually pay.

-
- - - - - - - - - - {atAGlance.map((row) => ( - - - - - - ))} - -
Dimension{vendor}Keycloak (with Phase Two)
{row.dim}{row.vendor}{row.keycloak}
+
+
+
Feature & cost comparison
+ + + + {matrix.rows.map((r) => ( + + + + + + ))} + +
{vendor}You
Keycloak + Phase Two
{r.feat}
+
+ {matrix.savings || "~80%"} avg. cost reduction on switch + +
+
) : null} - {/* Prose sections */} - {sections.map((s, i) => ( -
-
-
-

{s.title}

-
- {s.body} -
-
+ {after.map((s, i) => )} + + {/* Already using X? */} + {migration ? ( +
+
+
Migration
+

{migration.heading || `Already using ${vendor}?`}

+

{migration.body}

+ See how we migrate teams to Keycloak
- ))} - - {/* Migration band */} -
-
-
-

Already using {vendor}?

-

- Moving to Keycloak is more approachable than most teams expect. We import - users, broker authentication during a phased cutover, and move you off - {" "} - {vendor} without disrupting access. -

-
- - See how we migrate teams to Keycloak - -
-
-
-
+ ) : null} + + {/* FAQ */} {faqs.length ? ( -
-
-
-

Frequently asked questions

+
+
+
+
FAQ
+

Frequently asked questions

-
- {faqs.map((f) => ( -
-

{f.q}

-
{f.a}
-
+
+ {faqs.map((f, i) => ( +
+ {f.q} +
{f.a}
+
))}
@@ -211,23 +399,42 @@ export default function ComparisonLayout({ ) : null} {/* Cross-links */} -
-
- +
+
+
+
+

Compare Keycloak to other IAM platforms

+
See how Keycloak stacks up against the leading commercial identity providers.
+
+
+ {VENDOR_LINKS.filter((v) => v.key !== slug).map((v) => ( + {v.label} + ))} + View all alternatives → +
+
+
+
+ + {/* Big CTA */} +
+
+

{bigcta?.heading || "See how much you'd save."}

+

{bigcta?.body}

+
+ + +
+
- {/* CTA */} - -
+ setModalOpen(false)} + demoRequestEndpoint={demoRequestEndpoint} + turnstileSiteKey={turnstileSiteKey} + /> ); } diff --git a/src/components/comparison/Icon.jsx b/src/components/comparison/Icon.jsx new file mode 100644 index 00000000..9761c11a --- /dev/null +++ b/src/components/comparison/Icon.jsx @@ -0,0 +1,48 @@ +import React from "react"; + +// Inline SVG icons (Lucide paths) so the comparison pages don't need the +// external lucide CDN script. Sizing is handled by comparison.css (e.g. +// `.kcvs .btn svg`), with a 16px default for standalone use. +const PATHS = { + "arrow-left": <>, + "arrow-down": <>, + "arrow-right": <>, + "arrow-right-left": <>, + calendar: <>, + check: , + "check-circle-2": <>, + cloud: , + "file-text": <>, + "git-compare": <>, + "life-buoy": <>, + "message-square": , + minus: , + plus: <>, + "sliders-horizontal": <>, + "trending-down": <>, + x: <>, + zap: , +}; + +export default function Icon({ name, size = 16, className, style }) { + const path = PATHS[name]; + if (!path) return null; + return ( + + ); +} diff --git a/src/css/comparison.css b/src/css/comparison.css new file mode 100644 index 00000000..0baf0ed8 --- /dev/null +++ b/src/css/comparison.css @@ -0,0 +1,1339 @@ +/* ============================================================ + Phase Two — Keycloak vs. X comparison pages + Ported from the design handoff. ALL rules are scoped under + .kcvs so the dark-theme resets never leak into the rest of + the Docusaurus site. Site chrome (nav/announce/footer) is + intentionally omitted — the Docusaurus Layout provides it. + Per-page accent: add "accent-blue" to the .kcvs wrapper + (default is magenta). + ============================================================ */ + +.kcvs { + /* surfaces */ + --bg: #07090f; + --bg-2: #05070c; + --bg-3: #0a0e16; + --panel: #0c1019; + --panel-2: #0e1320; + --line: rgba(255, 255, 255, 0.08); + --line-2: rgba(255, 255, 255, 0.14); + /* ink */ + --ink: #eaf0f9; + --ink-2: #a6b2c4; + --muted: #6a7585; + /* brand */ + --primary: #3fa1e3; + --primary-2: #7fc4f0; + --magenta: #e14cc2; + --magenta-2: #f2a4de; + --success: #10b981; + --danger: #ef4444; + /* competitor accent — swappable per page */ + --vs: var(--magenta); + --vs-2: var(--magenta-2); + --vs-soft: rgba(225, 76, 194, 0.12); + --vs-line: rgba(225, 76, 194, 0.3); + + --radius: 14px; + --maxw: 1180px; + + background: var(--bg); + color: var(--ink); + font-family: + "Inter", + system-ui, + -apple-system, + sans-serif; + -webkit-font-smoothing: antialiased; + line-height: 1.5; + width: 100%; + margin-inline: auto; +} + +/* Infima's base rule sets `table { display: block }`, which makes our tables + ignore width:100% (columns shrink to content and sit left inside the bordered + box) and breaks rounded-corner clipping. Restore real table layout. */ +.kcvs table { + display: table; + width: 100%; + margin: 0; + border-collapse: collapse; +} +/* Infima adds `border: 1px solid` on every th/td plus its own padding. Our + design draws only horizontal separators (border-top), so strip Infima's + per-cell borders/padding — otherwise leftover left/right/bottom borders show + up as unwanted vertical column dividers and doubled lines. Each table's own + rules below re-add the borders and padding they actually want. */ +.kcvs th, +.kcvs td { + border: 0; + padding: 0; +} +.kcvs table thead tr { + border-top: 0; + border-bottom: 0; +} +.kcvs.accent-blue { + --vs: #3fa1e3; + --vs-2: #7fc4f0; + --vs-soft: rgba(63, 161, 227, 0.12); + --vs-line: rgba(63, 161, 227, 0.3); +} + +.kcvs * { + box-sizing: border-box; +} +.kcvs .num { + font-family: "JetBrains Mono", ui-monospace, monospace; + font-feature-settings: "tnum" 1; +} +.kcvs a { + color: inherit; + text-decoration: none; +} +.kcvs h1, +.kcvs h2, +.kcvs h3, +.kcvs h4 { + margin: 0; + letter-spacing: -0.02em; + font-weight: 600; +} +.kcvs p { + margin: 0; +} + +.kcvs .wrap { + max-width: var(--maxw); + margin: 0 auto; + padding: 0 32px; +} + +/* ---- shared atoms ---------------------------------------- */ +.kcvs .eyebrow { + display: inline-flex; + align-items: center; + gap: 8px; + font-size: 12px; + font-weight: 600; + letter-spacing: 0.04em; + text-transform: uppercase; + padding: 5px 12px; + border-radius: 999px; + background: rgba(63, 161, 227, 0.1); + border: 1px solid rgba(63, 161, 227, 0.28); + color: var(--primary-2); +} +.kcvs .eyebrow .dot { + width: 6px; + height: 6px; + border-radius: 50%; + background: var(--primary); + box-shadow: 0 0 8px var(--primary); +} +.kcvs .eyebrow.vs { + background: var(--vs-soft); + border-color: var(--vs-line); + color: var(--vs-2); +} +.kcvs .eyebrow.vs .dot { + background: var(--vs); + box-shadow: 0 0 8px var(--vs); +} + +.kcvs .btn { + display: inline-flex; + align-items: center; + justify-content: center; + gap: 8px; + font-size: 14px; + font-weight: 600; + cursor: pointer; + white-space: nowrap; + padding: 10px 18px; + border-radius: 999px; + border: 1px solid transparent; + transition: 0.18s; +} +.kcvs .btn svg { + width: 16px; + height: 16px; +} +.kcvs .btn-primary { + background: var(--primary); + color: #06121e; +} +.kcvs .btn-primary:hover { + background: var(--primary-2); +} +.kcvs .btn-vs { + background: var(--vs); + color: #16041a; +} +.kcvs .btn-vs:hover { + filter: brightness(1.08); +} +.kcvs .btn-ghost { + background: transparent; + border-color: var(--line-2); + color: var(--ink); +} +.kcvs .btn-ghost:hover { + background: rgba(255, 255, 255, 0.05); +} +.kcvs .btn-lg { + padding: 13px 24px; + font-size: 15px; +} + +.kcvs .link-arrow { + color: var(--primary); + font-weight: 600; + display: inline-flex; + align-items: center; + gap: 6px; +} +.kcvs .link-arrow:hover { + color: var(--primary-2); +} +.kcvs .ilink { + color: var(--primary); + font-weight: 500; +} +.kcvs .ilink:hover { + text-decoration: underline; + text-underline-offset: 3px; +} + +.kcvs .panel { + background: var(--panel); + border: 1px solid var(--line); + border-radius: var(--radius); +} +.kcvs .section { + padding: 96px 0; +} +.kcvs .section-sm { + padding: 72px 0; +} +.kcvs .lede { + color: var(--ink-2); + font-size: 17px; + line-height: 1.7; +} +.kcvs .kicker-num { + font-family: "JetBrains Mono", monospace; + font-size: 13px; + color: var(--vs); + letter-spacing: 0.08em; +} + +.kcvs .h-sec { + font-size: 34px; + line-height: 1.12; +} +@media (max-width: 720px) { + .kcvs .h-sec { + font-size: 27px; + } +} + +/* prose blocks under section headers */ +.kcvs .prose p { + color: var(--ink-2); + font-size: 15.5px; + line-height: 1.75; + max-width: 760px; +} +.kcvs .prose p + p { + margin-top: 18px; +} +.kcvs .prose .verdict { + display: inline-flex; + align-items: center; + gap: 8px; + margin-top: 6px; + font-weight: 600; + color: var(--ink); +} +.kcvs .verdict-tag { + font-size: 11px; + font-weight: 700; + letter-spacing: 0.06em; + text-transform: uppercase; + padding: 3px 9px; + border-radius: 6px; + background: rgba(16, 185, 129, 0.14); + color: var(--success); + border: 1px solid rgba(16, 185, 129, 0.3); +} +.kcvs .verdict-tag.depends { + background: rgba(63, 161, 227, 0.12); + color: var(--primary-2); + border-color: rgba(63, 161, 227, 0.3); +} +.kcvs .verdict-tag.tie { + background: rgba(255, 255, 255, 0.06); + color: var(--ink-2); + border-color: var(--line-2); +} + +/* ================= HERO ================= */ +.kcvs .hero { + position: relative; + overflow: hidden; + background: radial-gradient( + ellipse 80% 60% at 50% -8%, + #102036 0%, + var(--bg) 58% + ); + border-bottom: 1px solid var(--line); +} +.kcvs .hero .glow { + position: absolute; + inset: 0; + pointer-events: none; + background: radial-gradient( + circle at 50% 6%, + rgba(63, 161, 227, 0.18) 0%, + transparent 42% + ); +} +.kcvs .backlink { + display: inline-flex; + align-items: center; + gap: 7px; + font-size: 13px; + color: var(--ink-2); +} +.kcvs .backlink:hover { + color: var(--ink); +} +.kcvs .backlink svg { + width: 14px; + height: 14px; +} +.kcvs .hero-variant { + display: block; + margin: 0 auto; +} + +/* Variant A: centered versus lockup */ +.kcvs .heroA { + text-align: center; + padding: 72px 0 92px; + position: relative; + z-index: 2; +} +.kcvs .vs-lockup { + display: inline-flex; + align-items: center; + gap: 22px; + margin: 26px 0 30px 20px; +} +.kcvs .vs-lockup .chip { + display: flex; + align-items: center; + gap: 11px; + padding: 13px 20px; + border-radius: 14px; + background: var(--panel); + border: 1px solid var(--line); + font-weight: 700; + font-size: 18px; +} +.kcvs .vs-lockup .chip.p2 { + border-color: rgba(63, 161, 227, 0.4); + box-shadow: 0 0 26px rgba(63, 161, 227, 0.12); +} +.kcvs .vs-lockup .chip .badge-mark { + width: 30px; + height: 30px; + border-radius: 8px; + display: grid; + place-items: center; +} +.kcvs .vs-lockup .vs-x { + font-family: "JetBrains Mono", monospace; + font-size: 14px; + color: var(--muted); + letter-spacing: 0.1em; +} +.kcvs .comp-wm { + color: #fff; + font-weight: 800; + letter-spacing: -0.03em; + font-size: 20px; +} + +/* ---- Vendor wordmarks (SVGs are 140x60, monochrome #A0A9DB, dark-bg ready) ---- */ +/* Variant A: inside the competitor chip of the vs-lockup */ +.kcvs .vs-lockup .chip .vs-logo { + display: block; + height: 22px; + width: auto; +} +/* Variants B/C: above the "Keycloak vs. X" headline */ +.kcvs .hero-vendor-logo { + display: block; + height: 30px; + width: auto; + margin-bottom: 18px; +} +/* Hub card grid: replaces the square tile on the vendor cards */ +.kcvs .vcard .vcard-logo { + display: flex; + align-items: center; + height: 44px; + margin-bottom: 16px; +} +.kcvs .vcard .vcard-logo img { + height: 30px; + width: auto; + opacity: 0.9; + transition: opacity 0.18s; +} +.kcvs .vcard:hover .vcard-logo img { + opacity: 1; +} +/* Hub hero logo strip */ +.kcvs .hero-logostrip { + margin-top: 46px; + display: flex; + flex-direction: column; + align-items: center; + gap: 18px; +} +.kcvs .hero-logostrip .lbl { + font-size: 11px; + font-weight: 600; + letter-spacing: 0.08em; + text-transform: uppercase; + color: var(--muted); +} +.kcvs .hero-logostrip .logos { + display: flex; + flex-wrap: wrap; + align-items: center; + justify-content: center; + gap: 22px 40px; +} +.kcvs .hero-logostrip .logos img { + height: 36px; + width: auto; + opacity: 0.6; + transition: opacity 0.18s; +} +.kcvs .hero-logostrip .logos img:hover { + opacity: 0.95; +} +.kcvs .heroA h1 { + font-size: 60px; + line-height: 1.02; +} +.kcvs .heroA h1 .strike { + color: var(--muted); + text-decoration: line-through; + text-decoration-color: var(--vs); + text-decoration-thickness: 3px; +} +.kcvs .heroA h1 .grad { + background: linear-gradient(90deg, var(--primary-2), var(--primary)); + -webkit-background-clip: text; + background-clip: text; + -webkit-text-fill-color: transparent; +} +.kcvs .heroA .lede { + max-width: 660px; + margin: 22px auto 0; +} +.kcvs .heroA .lede b { + color: var(--ink); + font-weight: 600; +} +.kcvs .hero-cta { + display: flex; + gap: 12px; + align-items: center; + justify-content: center; + margin-top: 32px; + flex-wrap: wrap; +} +.kcvs .savings-pill { + display: inline-flex; + align-items: center; + gap: 10px; + margin-top: 30px; + padding: 9px 16px; + border-radius: 999px; + background: var(--vs-soft); + border: 1px solid var(--vs-line); + color: var(--vs-2); + font-size: 13px; + font-weight: 600; +} +.kcvs .savings-pill .num { + color: #fff; + font-size: 15px; +} +@media (max-width: 720px) { + .kcvs .heroA h1 { + font-size: 38px; + } + .kcvs .vs-lockup { + gap: 14px; + } +} + +/* Variant B: split thesis + mini comparison */ +.kcvs .heroB { + padding: 64px 0 84px; + position: relative; + z-index: 2; +} +.kcvs .hero-split { + display: grid; + grid-template-columns: 1fr 1fr; + gap: 48px; + align-items: center; +} +.kcvs .hero-split h1 { + font-size: 50px; + line-height: 1.04; + margin: 20px 0 0; +} +.kcvs .hero-split h1 .strike { + color: var(--muted); + text-decoration: line-through; + text-decoration-color: var(--vs); + text-decoration-thickness: 3px; +} +.kcvs .hero-split h1 .grad { + background: linear-gradient(90deg, var(--primary-2), var(--primary)); + -webkit-background-clip: text; + background-clip: text; + -webkit-text-fill-color: transparent; +} +.kcvs .hero-split .lede { + margin-top: 20px; + max-width: 520px; +} +.kcvs .hero-split .lede b { + color: var(--ink); + font-weight: 600; +} +.kcvs .replaces { + margin-top: 30px; +} +.kcvs .replaces .lbl { + font-size: 11px; + letter-spacing: 0.1em; + text-transform: uppercase; + color: var(--muted); + margin-bottom: 12px; +} +.kcvs .replaces .row { + display: flex; + flex-wrap: wrap; + gap: 10px 22px; +} +.kcvs .replaces .row span { + display: flex; + align-items: center; + gap: 8px; + font-size: 14px; + font-weight: 600; + color: var(--ink-2); +} +.kcvs .replaces .row span::before { + content: ""; + width: 6px; + height: 6px; + border-radius: 50%; + background: var(--vs); +} + +/* mini comparison card (hero card + main matrix) */ +.kcvs .cmp-card { + background: var(--panel); + border: 1px solid var(--line); + border-radius: var(--radius); + overflow: hidden; +} +.kcvs .cmp-head { + display: flex; + align-items: center; + justify-content: space-between; + padding: 15px 20px; + border-bottom: 1px solid var(--line); +} +.kcvs .cmp-head .t { + display: flex; + align-items: center; + gap: 9px; + font-size: 13px; + font-weight: 600; +} +.kcvs .cmp-head .ico { + width: 28px; + height: 28px; + border-radius: 8px; + display: grid; + place-items: center; + background: var(--vs-soft); + color: var(--vs); +} +.kcvs .cmp-head .ico svg { + width: 14px; + height: 14px; +} +.kcvs .cmp-grid { + width: 100%; + border-collapse: collapse; +} +.kcvs .cmp-grid th, +.kcvs .cmp-grid td { + padding: 15px 20px; + text-align: center; + font-size: 13px; + border-top: 1px solid var(--line); +} +.kcvs .cmp-grid thead th { + border-top: none; + padding-top: 16px; + padding-bottom: 10px; +} +.kcvs .cmp-grid th.feat, +.kcvs .cmp-grid td.feat { + text-align: left; + color: var(--ink-2); + font-weight: 400; + width: 46%; +} +.kcvs .cmp-grid thead th { + font-size: 12px; + font-weight: 600; + color: var(--muted); +} +.kcvs .cmp-grid thead th.you { + color: #fff; +} +.kcvs .you-tag { + display: inline-block; + font-size: 9px; + font-weight: 700; + letter-spacing: 0.06em; + text-transform: uppercase; + padding: 2px 7px; + border-radius: 999px; + background: rgba(63, 161, 227, 0.18); + color: var(--primary); + margin-bottom: 4px; +} +.kcvs .cmp-foot { + display: flex; + align-items: center; + justify-content: space-between; + padding: 14px 20px; + border-top: 1px solid var(--line); + background: rgba(63, 161, 227, 0.05); + font-size: 12.5px; + color: var(--ink-2); +} +.kcvs .cell-yes { + display: inline-grid; + place-items: center; + width: 24px; + height: 24px; + border-radius: 50%; + background: rgba(16, 185, 129, 0.15); + color: var(--success); +} +.kcvs .cell-no { + display: inline-grid; + place-items: center; + width: 24px; + height: 24px; + border-radius: 50%; + background: rgba(239, 68, 68, 0.12); + color: var(--danger); +} +.kcvs .cell-lim { + display: inline-grid; + place-items: center; + width: 24px; + height: 24px; + border-radius: 50%; + background: rgba(255, 255, 255, 0.06); + color: var(--muted); +} +.kcvs .cell-cost { + display: inline-grid; + place-items: center; + padding: 0 9px; + height: 24px; + border-radius: 7px; + font-size: 11px; + font-weight: 700; + background: var(--vs-soft); + color: var(--vs); +} +.kcvs .cell-yes svg, +.kcvs .cell-no svg, +.kcvs .cell-lim svg { + width: 14px; + height: 14px; +} +@media (max-width: 880px) { + .kcvs .hero-split { + grid-template-columns: 1fr; + } + .kcvs .hero-split h1 { + font-size: 36px; + } +} + +/* Variant C: headline + cost-curve chart */ +.kcvs .heroC { + padding: 64px 0 84px; + position: relative; + z-index: 2; +} +.kcvs .hero-chart-grid { + display: grid; + grid-template-columns: 1.05fr 1fr; + gap: 52px; + align-items: center; +} +.kcvs .hero-chart-grid h1 { + font-size: 48px; + line-height: 1.05; + margin-top: 20px; +} +.kcvs .hero-chart-grid h1 .grad { + background: linear-gradient(90deg, var(--primary-2), var(--primary)); + -webkit-background-clip: text; + background-clip: text; + -webkit-text-fill-color: transparent; +} +.kcvs .hero-chart-grid .lede { + margin-top: 18px; + max-width: 500px; +} +.kcvs .chart-card { + background: var(--panel); + border: 1px solid var(--line); + border-radius: var(--radius); + padding: 22px; +} +.kcvs .chart-card .ct { + display: flex; + align-items: center; + justify-content: space-between; + margin-bottom: 6px; +} +.kcvs .chart-card .ct .t { + font-size: 13px; + font-weight: 600; +} +.kcvs .chart-legend { + display: flex; + gap: 18px; + margin-top: 14px; + font-size: 12px; + color: var(--ink-2); +} +.kcvs .chart-legend span { + display: flex; + align-items: center; + gap: 7px; +} +.kcvs .chart-legend i { + width: 14px; + height: 3px; + border-radius: 2px; + display: inline-block; +} +@media (max-width: 880px) { + .kcvs .hero-chart-grid { + grid-template-columns: 1fr; + } + .kcvs .hero-chart-grid h1 { + font-size: 34px; + } +} + +/* ================= AT A GLANCE ================= */ +.kcvs .glance { + background: var(--bg-2); + border-top: 1px solid var(--line); + border-bottom: 1px solid var(--line); +} +.kcvs .glance .head { + text-align: center; + margin-bottom: 40px; +} +.kcvs .gtable { + width: 100%; + border-collapse: collapse; + border: 1px solid var(--line); + border-radius: var(--radius); + overflow: hidden; + background: var(--panel); +} +.kcvs .gtable thead th { + text-align: left; + font-size: 11px; + font-weight: 700; + letter-spacing: 0.08em; + text-transform: uppercase; + color: var(--muted); + padding: 18px 26px; + background: var(--bg-3); + border-bottom: 1px solid var(--line); +} +.kcvs .gtable thead th.p2col { + color: var(--primary-2); +} +.kcvs .gtable td { + padding: 20px 26px; + font-size: 14.5px; + border-top: 1px solid var(--line); + vertical-align: top; +} +.kcvs .gtable td.dim { + font-weight: 600; + color: var(--ink); + width: 24%; +} +.kcvs .gtable td.comp { + color: var(--ink-2); + width: 38%; +} +.kcvs .gtable td.p2 { + color: var(--ink); + width: 38%; +} +.kcvs .gtable td.p2 .ok { + color: var(--success); + margin-right: 7px; +} +.kcvs .gtable tbody tr:hover { + background: rgba(255, 255, 255, 0.015); +} +.kcvs .gtable .p2col-cell { + background: rgba(63, 161, 227, 0.04); +} +@media (max-width: 720px) { + .kcvs .gtable thead { + display: none; + } + .kcvs .gtable td { + display: block; + width: auto !important; + } + .kcvs .gtable td.dim { + padding-bottom: 4px; + } + .kcvs .gtable tr { + display: block; + border-top: 1px solid var(--line); + } +} + +/* ================= CONTENT SECTIONS ================= */ +.kcvs .content-sec { + border-top: 1px solid var(--line); +} +.kcvs .content-sec.alt { + background: var(--bg-2); +} +.kcvs .sec-grid { + display: grid; + grid-template-columns: 300px 1fr; + gap: 56px; +} +.kcvs .sec-grid .left .h-sec { + position: sticky; + top: 96px; +} +.kcvs .sec-grid .left .kicker-num { + display: block; + margin-bottom: 14px; +} +@media (max-width: 880px) { + .kcvs .sec-grid { + grid-template-columns: 1fr; + gap: 24px; + } + .kcvs .sec-grid .left .h-sec { + position: static; + } +} + +/* pricing table (competitor plans) */ +.kcvs .ptable { + width: 100%; + border-collapse: collapse; + margin: 24px 0 8px; + border: 1px solid var(--line); + border-radius: 12px; + overflow: hidden; + background: var(--bg-3); +} +.kcvs .ptable th { + text-align: left; + font-size: 11px; + letter-spacing: 0.06em; + text-transform: uppercase; + color: var(--muted); + font-weight: 700; + padding: 16px 20px; + border-bottom: 1px solid var(--line); +} +.kcvs .ptable td { + padding: 16px 20px; + font-size: 13.5px; + border-top: 1px solid var(--line); + color: var(--ink-2); + vertical-align: top; +} +.kcvs .ptable td.plan { + font-weight: 600; + color: var(--ink); +} +.kcvs .ptable td.price { + font-family: "JetBrains Mono", monospace; + color: #fff; + white-space: nowrap; +} +.kcvs .footnote { + font-size: 12px; + color: var(--muted); + line-height: 1.6; + margin-top: 10px; +} + +/* ================= FEATURE MATRIX ================= */ +.kcvs .matrix-sec { + background: var(--bg-2); + border-top: 1px solid var(--line); +} +.kcvs .matrix-sec .head { + text-align: center; + margin-bottom: 40px; +} +.kcvs .matrix-wrap { + max-width: 920px; + margin: 0 auto; +} + +/* ================= HOSTING + SUPPORT ================= */ +.kcvs .duo { + display: grid; + grid-template-columns: 1fr 1fr; + gap: 22px; +} +.kcvs .duo .card { + padding: 36px; + min-height: 380px; + display: flex; + flex-direction: column; + position: relative; + overflow: hidden; + background: var(--panel); + border: 1px solid var(--line); + border-radius: var(--radius); +} +.kcvs .duo .card .tile { + width: 48px; + height: 48px; + border-radius: 14px; + display: grid; + place-items: center; + margin-bottom: 20px; +} +.kcvs .duo .card .tile svg { + width: 22px; + height: 22px; +} +.kcvs .duo .card h3 { + font-size: 26px; + margin-bottom: 10px; +} +.kcvs .duo .card ul { + list-style: none; + padding: 0; + margin: 18px 0 26px; + display: flex; + flex-direction: column; + gap: 11px; +} +.kcvs .duo .card li { + display: flex; + align-items: center; + gap: 10px; + font-size: 14px; + color: var(--ink-2); +} +.kcvs .duo .card li svg { + width: 16px; + height: 16px; + color: var(--success); + flex-shrink: 0; +} +.kcvs .duo .card .ftr { + margin-top: auto; + display: flex; + align-items: center; + gap: 14px; +} +@media (max-width: 880px) { + .kcvs .duo { + grid-template-columns: 1fr; + } +} + +/* ================= MIGRATION / ALREADY USING ================= */ +.kcvs .using { + background: var(--bg-2); + border-top: 1px solid var(--line); + text-align: center; +} +.kcvs .using .inner { + max-width: 680px; + margin: 0 auto; +} + +/* ================= FAQ ================= */ +.kcvs .faq { + border-top: 1px solid var(--line); +} +.kcvs .faq .head { + text-align: center; + margin-bottom: 44px; +} +.kcvs .faq-list { + max-width: 820px; + margin: 0 auto; +} +.kcvs .faq details { + border-bottom: 1px solid var(--line); +} +.kcvs .faq summary { + list-style: none; + cursor: pointer; + padding: 22px 4px; + display: flex; + align-items: center; + justify-content: space-between; + gap: 20px; + font-size: 17px; + font-weight: 600; + color: var(--ink); +} +.kcvs .faq summary::-webkit-details-marker { + display: none; +} +.kcvs .faq summary .pm { + flex-shrink: 0; + width: 22px; + height: 22px; + display: grid; + place-items: center; + color: var(--muted); + transition: 0.2s; +} +.kcvs .faq details[open] summary .pm { + transform: rotate(45deg); + color: var(--primary); +} +.kcvs .faq .ans { + padding: 0 4px 24px; +} +.kcvs .faq .ans p { + color: var(--ink-2); + font-size: 15px; + line-height: 1.7; + max-width: 720px; +} + +/* ================= CROSS-LINKS + BOTTOM CTA ================= */ +.kcvs .crosslinks { + background: var(--bg-2); + border-top: 1px solid var(--line); +} +.kcvs .crosslinks .panel { + padding: 30px 34px; + display: flex; + align-items: center; + justify-content: space-between; + gap: 24px; + flex-wrap: wrap; +} +.kcvs .crosslinks h4 { + font-size: 18px; + margin-bottom: 4px; +} +.kcvs .crosslinks .sub { + font-size: 13px; + color: var(--muted); +} +.kcvs .crosslinks .chips { + display: flex; + gap: 10px; + flex-wrap: wrap; +} +.kcvs .crosslinks .chips a { + font-size: 13px; + font-weight: 600; + color: var(--primary); + padding: 8px 14px; + border: 1px solid var(--line-2); + border-radius: 999px; +} +.kcvs .crosslinks .chips a:hover { + background: rgba(63, 161, 227, 0.08); + border-color: rgba(63, 161, 227, 0.4); +} + +.kcvs .bigcta { + position: relative; + overflow: hidden; + text-align: center; + background: linear-gradient(120deg, #1d5c8e 0%, #2e7fb8 100%); +} +.kcvs .bigcta h2 { + font-size: 42px; + line-height: 1.08; + color: #fff; +} +.kcvs .bigcta p { + color: rgba(255, 255, 255, 0.85); + font-size: 17px; + margin: 14px auto 30px; + max-width: 560px; +} +.kcvs .bigcta .btn-primary { + background: #fff; + color: #0e3552; +} +.kcvs .bigcta .btn-primary:hover { + background: #eaf3fb; +} +.kcvs .bigcta .btn-ghost { + border-color: rgba(255, 255, 255, 0.5); + color: #fff; +} + +/* ================= INDEX / HUB EXTRAS ================= */ +.kcvs .thesis { + background: var(--bg-2); + border-top: 1px solid var(--line); + border-bottom: 1px solid var(--line); + text-align: center; +} +.kcvs .thesis h2 { + font-size: 36px; + line-height: 1.25; + font-weight: 600; + max-width: 1000px; + margin: 0 auto; + letter-spacing: -0.01em; +} +.kcvs .thesis h2 .grad { + background: linear-gradient(90deg, var(--primary-2), var(--primary)); + -webkit-background-clip: text; + background-clip: text; + -webkit-text-fill-color: transparent; +} +@media (max-width: 720px) { + .kcvs .thesis h2 { + font-size: 24px; + } +} +.kcvs .hubtable { + width: 100%; + border-collapse: collapse; + border: 1px solid var(--line); + border-radius: var(--radius); + overflow: hidden; + background: var(--panel); +} +.kcvs .hubtable thead th { + text-align: left; + font-size: 11px; + font-weight: 700; + letter-spacing: 0.07em; + text-transform: uppercase; + color: var(--muted); + padding: 18px 22px; + background: var(--bg-3); + border-bottom: 1px solid var(--line); +} +.kcvs .hubtable td { + padding: 18px 22px; + font-size: 14px; + border-top: 1px solid var(--line); + color: var(--ink-2); + vertical-align: top; +} +.kcvs .hubtable td.plat { + font-weight: 600; + color: var(--ink); +} +.kcvs .hubtable tr.p2row td { + background: rgba(63, 161, 227, 0.05); +} +.kcvs .hubtable tr.p2row td.plat { + color: #fff; +} +.kcvs .hubtable td .yes { + color: var(--success); + font-weight: 600; +} +.kcvs .hubtable td .no { + color: var(--muted); +} +.kcvs .hubtable td a { + color: var(--primary); + font-weight: 600; + white-space: nowrap; +} +.kcvs .hubtable td a:hover { + text-decoration: underline; +} +.kcvs .hubtable tbody tr:hover td { + background: rgba(255, 255, 255, 0.015); +} +.kcvs .hubtable tr.p2row:hover td { + background: rgba(63, 161, 227, 0.07); +} + +/* hub hero — centered mark + headline */ +.kcvs .hubHero { + text-align: center; + padding: 84px 0 96px; + position: relative; + z-index: 2; + margin: 0 auto; +} +.kcvs .hub-mark { + position: relative; + width: 140px; + height: 140px; + margin: 0 auto 80px; + display: grid; + place-items: center; +} +.kcvs .hub-mark .ring { + position: absolute; + inset: 0; + border-radius: 50%; + border: 1px solid rgba(63, 161, 227, 0.25); +} +.kcvs .hub-mark .ring.r2 { + inset: -22px; + border-color: rgba(63, 161, 227, 0.14); +} +.kcvs .hub-mark .ring.r3 { + inset: -46px; + border-color: rgba(63, 161, 227, 0.07); +} +.kcvs .hub-mark .glyph { + width: 88px; + height: 88px; + border-radius: 22px; + display: grid; + place-items: center; + background: linear-gradient(160deg, #1a2740, #0c1320); + border: 1px solid var(--line-2); + box-shadow: + 0 0 0 1px rgba(63, 161, 227, 0.2), + 0 22px 60px rgba(63, 161, 227, 0.25); +} +.kcvs .hub-mark .glyph img { + width: 46px; +} +.kcvs .hub-mark .spark { + position: absolute; + width: 7px; + height: 7px; + border-radius: 50%; + background: var(--primary); + box-shadow: 0 0 10px var(--primary); +} +.kcvs .hubHero h1 { + font-size: 58px; + line-height: 1.02; + margin-bottom: 24px; +} +.kcvs .hubHero .lede { + max-width: 680px; + margin: 0 auto; +} +@media (max-width: 720px) { + .kcvs .hubHero h1 { + font-size: 38px; + } +} + +.kcvs .cardgrid { + display: grid; + grid-template-columns: repeat(3, 1fr); + gap: 18px; +} +.kcvs .vcard { + display: block; + background: var(--panel); + border: 1px solid var(--line); + border-radius: var(--radius); + padding: 24px; + transition: 0.18s; +} +.kcvs .vcard:hover { + border-color: var(--vs-line); + transform: translateY(-2px); +} +.kcvs .vcard .vtile { + width: 44px; + height: 44px; + border-radius: 12px; + display: grid; + place-items: center; + background: var(--vs-soft); + color: var(--vs); + margin-bottom: 16px; +} +.kcvs .vcard .vtile svg { + width: 20px; + height: 20px; +} +.kcvs .vcard h3 { + font-size: 19px; + margin-bottom: 6px; +} +.kcvs .vcard p { + font-size: 13.5px; + color: var(--ink-2); + line-height: 1.55; +} +.kcvs .vcard .go { + margin-top: 16px; + font-size: 13px; + font-weight: 600; + color: var(--primary); + display: inline-flex; + align-items: center; + gap: 6px; +} +@media (max-width: 880px) { + .kcvs .cardgrid { + grid-template-columns: 1fr 1fr; + } +} +@media (max-width: 600px) { + .kcvs .cardgrid { + grid-template-columns: 1fr; + } +} diff --git a/src/css/custom.css b/src/css/custom.css index 07271901..bff32038 100644 --- a/src/css/custom.css +++ b/src/css/custom.css @@ -1,4 +1,5 @@ /* stylelint-disable docusaurus/copyright-header */ +@import "./comparison.css"; /** * Any CSS included here will be global. The classic template * bundles Infima by default. Infima is a CSS framework designed to diff --git a/src/pages/keycloak-alternatives.jsx b/src/pages/keycloak-alternatives.jsx index add2bdae..9141af94 100644 --- a/src/pages/keycloak-alternatives.jsx +++ b/src/pages/keycloak-alternatives.jsx @@ -2,10 +2,13 @@ import Head from "@docusaurus/Head"; import Link from "@docusaurus/Link"; import Layout from "@theme/Layout"; import React from "react"; -import Cta from "../components/ctas/homepage-dual-line-cta"; +import Icon from "../components/comparison/Icon"; + +const SITE = "https://phasetwo.io"; +const DASH = "https://dash.phasetwo.io/"; const PAGE_META = { - title: "Keycloak Alternatives: Compare Keycloak to Auth0, Okta, WorkOS & More", + title: "Keycloak Alternatives — Phase Two", description: "Compare Keycloak to the leading commercial IAM platforms — Auth0, Okta, WorkOS, Ping Identity, FrontEgg, and OneLogin. See why managed open-source Keycloak is a flexible, cost-predictable alternative.", keywords: @@ -13,121 +16,60 @@ const PAGE_META = { url: "https://phasetwo.io/keycloak-alternatives/", }; -const HERO_IMG = "/img/hero-opensource-vs-commercial.svg"; +const ROWS = [ + { vendor: "Auth0", to: "/keycloak-alternatives/auth0/", pricing: "Per-MAU + feature tiers; cost climbs with users and add-ons", deployment: "Cloud SaaS only", onPrem: false, knownFor: "Developer-friendly managed auth" }, + { vendor: "Okta", to: "/keycloak-alternatives/okta/", pricing: "Per-user, per-feature; enterprise bands add up", deployment: "Cloud SaaS only", onPrem: false, knownFor: "Enterprise workforce identity" }, + { vendor: "WorkOS", to: "/keycloak-alternatives/workos/", pricing: "Per-connection / per-org enterprise SSO", deployment: "Cloud SaaS only", onPrem: false, knownFor: "Enterprise-ready SSO/SCIM for SaaS" }, + { vendor: "Ping Identity", to: "/keycloak-alternatives/ping-identity/", pricing: "Enterprise contracts; quote-based", deployment: "Cloud + self-managed options", onPrem: true, knownFor: "Large-enterprise IAM suites" }, + { vendor: "FrontEgg", to: "/keycloak-alternatives/frontegg/", pricing: "Per-MAU tiers; B2B feature gating", deployment: "Cloud SaaS only", onPrem: false, knownFor: "Embedded B2B user management" }, + { vendor: "OneLogin", to: "/keycloak-alternatives/onelogin/", pricing: "Per-user, per-module", deployment: "Cloud SaaS only", onPrem: false, knownFor: "Workforce SSO & access management" }, +]; -// Each spoke is an existing, full comparison post. Do not duplicate their content -// here — this hub frames the cluster and links down to each one. -const COMPARISONS = [ - { - vendor: "Auth0", - to: "/keycloak-alternatives/auth0/", - pricing: "Per-MAU + feature tiers; cost climbs with users and add-ons", - deployment: "Cloud SaaS only", - onPrem: "No", - knownFor: "Developer-friendly managed auth", - }, - { - vendor: "Okta", - to: "/keycloak-alternatives/okta/", - pricing: "Per-user, per-feature; enterprise bands add up", - deployment: "Cloud SaaS only", - onPrem: "No", - knownFor: "Enterprise workforce identity", - }, - { - vendor: "WorkOS", - to: "/keycloak-alternatives/workos/", - pricing: "Per-connection / per-org enterprise SSO", - deployment: "Cloud SaaS only", - onPrem: "No", - knownFor: "Enterprise-ready SSO/SCIM for SaaS", - }, - { - vendor: "Ping Identity", - to: "/keycloak-alternatives/ping-identity/", - pricing: "Enterprise contracts; quote-based", - deployment: "Cloud + self-managed options", - onPrem: "Yes", - knownFor: "Large-enterprise IAM suites", - }, - { - vendor: "FrontEgg", - to: "/keycloak-alternatives/frontegg/", - pricing: "Per-MAU tiers; B2B feature gating", - deployment: "Cloud SaaS only", - onPrem: "No", - knownFor: "Embedded B2B user management", - }, - { - vendor: "OneLogin", - to: "/keycloak-alternatives/onelogin/", - pricing: "Per-user, per-module", - deployment: "Cloud SaaS only", - onPrem: "No", - knownFor: "Workforce SSO & access management", - }, +const VENDOR_LOGOS = [ + { name: "Auth0", src: "/customer-logos/auth0.svg" }, + { name: "Okta", src: "/customer-logos/okta.svg" }, + { name: "WorkOS", src: "/customer-logos/workos.svg" }, + { name: "Ping Identity", src: "/customer-logos/ping-identity.svg" }, + { name: "FrontEgg", src: "/customer-logos/frontegg.svg" }, + { name: "OneLogin", src: "/customer-logos/onelogin.svg" }, +]; + +const CARDS = [ + { to: "/keycloak-alternatives/auth0/", logo: "/customer-logos/auth0.svg", title: "vs Auth0", desc: "Open-source alternative to Auth0 — without per-MAU pricing.", cta: "Compare" }, + { to: "/keycloak-alternatives/okta/", logo: "/customer-logos/okta.svg", title: "vs Okta", desc: "Open-source alternative to Okta — for cost and deployment control.", cta: "Compare" }, + { to: "/keycloak-alternatives/workos/", logo: "/customer-logos/workos.svg", title: "vs WorkOS", desc: "Open-source alternative to WorkOS — no per-connection toll.", cta: "Compare" }, + { to: "/keycloak-alternatives/ping-identity/", logo: "/customer-logos/ping-identity.svg", title: "vs Ping Identity", desc: "Open-source alternative to Ping — without the suite contract.", cta: "Compare" }, + { to: "/keycloak-alternatives/frontegg/", logo: "/customer-logos/frontegg.svg", title: "vs FrontEgg", desc: "Open-source alternative to FrontEgg — B2B without per-MAU cost.", cta: "Compare" }, + { to: "/keycloak-alternatives/onelogin/", logo: "/customer-logos/onelogin.svg", title: "vs OneLogin", desc: "Open-source alternative to OneLogin — no per-module pricing.", cta: "Compare" }, + { to: "/blog/open-source-iam/", icon: "file-text", title: "Open-Source IAM", desc: "The roundup — why open standards beat vendor lock-in.", cta: "Read" }, + { to: "/hosting/", icon: "cloud", title: "Managed Hosting", desc: "Run Keycloak with Phase Two — fixed cost, zero ops burden.", cta: "Learn more" }, ]; const FAQS = [ { q: "What is the best open-source alternative to Auth0?", - a: ( -

- Keycloak is the most widely adopted open-source alternative to Auth0. It supports the same - core standards (OAuth 2.0, OpenID Connect, SAML) and matches Auth0 on most authentication - and authorization features, while being free of per-user licensing. The main trade-off is - operational overhead, which a managed host like Phase Two removes. See our full{" "} - Keycloak vs. Auth0{" "} - comparison. -

- ), + a:

Keycloak is the most widely adopted open-source alternative to Auth0. It supports the same core standards (OAuth 2.0, OpenID Connect, SAML) and matches Auth0 on most authentication and authorization features, while being free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes. See our full Keycloak vs. Auth0 comparison.

, + text: "Keycloak is the most widely adopted open-source alternative to Auth0. It supports OAuth 2.0, OpenID Connect, and SAML and matches Auth0 on most features, without per-user licensing. A managed host like Phase Two removes the operational overhead.", }, { q: "What is the best alternative to Okta?", - a: ( -

- For teams that want control over deployment and cost, Keycloak is a strong Okta alternative — - especially where on-premise or data-residency requirements rule out a cloud-only vendor. - Read{" "} - Keycloak vs. Okta for a - feature-by-feature look. -

- ), + a:

For teams that want control over deployment and cost, Keycloak is a strong Okta alternative — especially where on-premise or data-residency requirements rule out a cloud-only vendor. Read Keycloak vs. Okta for a feature-by-feature look.

, + text: "Keycloak is a strong Okta alternative for teams that want control over deployment and cost, especially where on-premise or data-residency requirements rule out a cloud-only vendor.", }, { q: "Is Keycloak cheaper than Auth0?", - a: ( -

- For most growing applications, yes. Commercial IAM pricing scales with monthly active users - and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays - largely fixed as your user base grows. Teams moving to managed Keycloak frequently see - substantial savings. Estimate it on our{" "} - hosting pricing page. -

- ), + a:

For most growing applications, yes. Commercial IAM pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows. Teams moving to managed Keycloak frequently see substantial savings. Estimate it on our hosting pricing page.

, + text: "For most growing applications, yes. Commercial IAM pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows.", }, { q: "Can I migrate off Auth0, Okta, or Cognito to Keycloak?", - a: ( -

- Yes. Keycloak can import your users and broker authentication to your existing provider - during a phased cutover, so you can migrate incrementally without disrupting users. We've - built tooling and a process for exactly this — see{" "} - Migrate to Keycloak. -

- ), + a:

Yes. Keycloak can import your users and broker authentication to your existing provider during a phased cutover, so you can migrate incrementally without disrupting users. We've built tooling and a process for exactly this — see Migrate to Keycloak.

, + text: "Yes. Keycloak can import your users and broker authentication to your existing provider during a phased cutover, so you can migrate incrementally without disrupting users.", }, { q: "Is Keycloak a good alternative to commercial IAM?", - a: ( -

- Keycloak offers feature parity with virtually every commercial IAM platform on the core - standards, plus full source access and on-premise deployment options that SaaS-only vendors - can't match. Paired with managed hosting, you get that openness without the operational - burden. Read the{" "} - open-source IAM overview. -

- ), + a:

Keycloak offers feature parity with virtually every commercial IAM platform on the core standards, plus full source access and on-premise deployment options that SaaS-only vendors can't match. Paired with managed hosting, you get that openness without the operational burden. Read the open-source IAM overview.

, + text: "Keycloak offers feature parity with commercial IAM platforms on core standards, plus full source access and on-premise deployment options. Paired with managed hosting, you get that openness without the operational burden.", }, ]; @@ -135,52 +77,20 @@ export default function KeycloakAlternatives() { const faqJsonLd = { "@context": "https://schema.org", "@type": "FAQPage", - mainEntity: FAQS.map((f) => ({ - "@type": "Question", - name: f.q, - acceptedAnswer: { - "@type": "Answer", - // Plain-text answers for the FAQ rich result. - text: - { - "What is the best open-source alternative to Auth0?": - "Keycloak is the most widely adopted open-source alternative to Auth0. It supports OAuth 2.0, OpenID Connect, and SAML and matches Auth0 on most features, without per-user licensing. A managed host like Phase Two removes the operational overhead.", - "What is the best alternative to Okta?": - "Keycloak is a strong Okta alternative for teams that want control over deployment and cost, especially where on-premise or data-residency requirements rule out a cloud-only vendor.", - "Is Keycloak cheaper than Auth0?": - "For most growing applications, yes. Commercial IAM pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows.", - "Can I migrate off Auth0, Okta, or Cognito to Keycloak?": - "Yes. Keycloak can import your users and broker authentication to your existing provider during a phased cutover, so you can migrate incrementally without disrupting users.", - "Is Keycloak a good alternative to commercial IAM?": - "Keycloak offers feature parity with commercial IAM platforms on core standards, plus full source access and on-premise deployment options. Paired with managed hosting, you get that openness without the operational burden.", - }[f.q] || "", - }, - })), + mainEntity: FAQS.map((f) => ({ "@type": "Question", name: f.q, acceptedAnswer: { "@type": "Answer", text: f.text } })), }; - const itemListJsonLd = { "@context": "https://schema.org", "@type": "ItemList", name: "Keycloak vs. commercial IAM comparisons", - itemListElement: COMPARISONS.map((c, i) => ({ - "@type": "ListItem", - position: i + 1, - name: `Keycloak vs. ${c.vendor}`, - url: `https://phasetwo.io${c.to}`, - })), + itemListElement: ROWS.map((c, i) => ({ "@type": "ListItem", position: i + 1, name: `Keycloak vs. ${c.vendor}`, url: `${SITE}${c.to}` })), }; - const breadcrumbJsonLd = { "@context": "https://schema.org", "@type": "BreadcrumbList", itemListElement: [ - { "@type": "ListItem", position: 1, name: "Home", item: "https://phasetwo.io/" }, - { - "@type": "ListItem", - position: 2, - name: "Keycloak Alternatives", - item: PAGE_META.url, - }, + { "@type": "ListItem", position: 1, name: "Home", item: `${SITE}/` }, + { "@type": "ListItem", position: 2, name: "Keycloak Alternatives", item: PAGE_META.url }, ], }; @@ -198,176 +108,148 @@ export default function KeycloakAlternatives() { -
+
{/* Hero */} -
-
-
-
-
- -
- -

Keycloak Alternatives

-

- Evaluating Auth0, Okta, WorkOS, or another commercial IAM? Keycloak is the - open-source alternative that matches them on standards and features — without - per-user licensing or vendor lock-in. Paired with Phase Two managed hosting, you - get that control with fixed, predictable costs and none of the operational burden. -

- -
- - - - - Compare the platforms - +
+
+
+
+
+ + + + + +
+
+

Keycloak Alternatives

+

Evaluating Auth0, Okta, WorkOS, or another commercial IAM? Keycloak is the open-source alternative that matches them on standards and features — without per-user licensing or vendor lock-in. Paired with Phase Two managed hosting, you get that control with fixed, predictable costs and none of the operational burden.

+ +
+ Compare Keycloak against +
+ {VENDOR_LOGOS.map((v) => ( + {v.name} + ))}
-
-
+ + - {/* Intro */} -
-
-
-

- On the core standards — OIDC, OAuth 2.0, and SAML — Keycloak offers parity with - virtually every commercial IAM platform. The real differences are cost model, - deployment flexibility, and how far you can extend the system. Here's how Keycloak - compares to the vendors teams ask us about most. -

-
+ {/* Thesis */} +
+
+

On the core standards — OIDC, OAuth 2.0, and SAML — Keycloak offers parity with virtually every commercial IAM platform. The real differences are cost model, deployment flexibility, and how far you can extend the system.

- {/* Comparison matrix */} -
-
-
-

Keycloak vs. commercial IAM at a glance

-

- A high-level view of how each platform is licensed and deployed. Follow any row for - the full, feature-by-feature comparison. -

+ {/* Hub table */} +
+
+
+
Compare Keycloak
+

Keycloak vs. commercial IAM at a glance

+

A high-level view of how each platform is licensed and deployed. Follow any row for the full, feature-by-feature comparison.

- -
- +
+
- - - - - - - - + - - + + - + - + - {COMPARISONS.map((c) => ( - - - - - - - + {ROWS.map((r) => ( + + + + + + + ))}
PlatformPricing modelDeploymentOn-premiseBest known forCompare
PlatformPricing modelDeploymentOn-premiseBest known forCompare
Keycloak (with Phase Two)
Keycloak (with Phase Two) Fixed hosting cost, not per-user Self-hosted, your cloud, on-prem, or managedYesYes Open-source, extensible IAM - Managed hosting → - Managed hosting →
{c.vendor}{c.pricing}{c.deployment}{c.onPrem}{c.knownFor} - Keycloak vs. {c.vendor} → -
{r.vendor}{r.pricing}{r.deployment}{r.onPrem ? Yes : No}{r.knownFor}Keycloak vs. {r.vendor} →
- -

- Pricing models are summarized for orientation and reflect each vendor's general - approach, not a quote. Commercial pricing changes frequently — confirm current rates - with each vendor.{" "} - {/* TODO: verify — keep cells qualitative; do not insert specific competitor prices without a source. */} -

- -
- - Read the open-source IAM overview - +

Pricing models are summarized for orientation and reflect each vendor's general approach, not a quote. Commercial pricing changes frequently — confirm current rates with each vendor.

+
+ Read the open-source IAM overview
- {/* Migration band */} -
-
-
-

Already on Auth0, Okta, or Cognito?

-

- Moving to Keycloak is more approachable than most teams expect. We import users, - broker authentication during a phased cutover, and move you off your current vendor - without disrupting access. -

-
- - See how we migrate teams to Keycloak + {/* Vendor card grid */} +
+
+
+

Pick a head-to-head comparison

+
+
+ {CARDS.map((c) => ( + + {c.logo ? ( +
+ ) : ( +
+ )} +

{c.title}

+

{c.desc}

+ {c.cta} -
+ ))}
+ {/* Already using */} +
+
+
Migration
+

Already on Auth0, Okta, or Cognito?

+

Moving to Keycloak is more approachable than most teams expect. We import users, broker authentication during a phased cutover, and move you off your current vendor without disrupting access.

+ See how we migrate teams to Keycloak +
+
+ {/* FAQ */} -
-
-
-

Frequently asked questions

+
+
+
+
FAQ
+

Frequently asked questions

-
- {FAQS.map((f) => ( -
-

{f.q}

-
{f.a}
-
+
+ {FAQS.map((f, i) => ( +
+ {f.q} +
{f.a}
+
))}
- {/* CTA */} - -
+ {/* Bottom CTA */} +
+
+

Ready to Try Keycloak?
Create your free deployment today.

+ +
+
+ ); } diff --git a/src/pages/keycloak-alternatives/auth0.jsx b/src/pages/keycloak-alternatives/auth0.jsx index 94d23d1a..7485f29b 100644 --- a/src/pages/keycloak-alternatives/auth0.jsx +++ b/src/pages/keycloak-alternatives/auth0.jsx @@ -3,265 +3,199 @@ import React from "react"; import ComparisonLayout from "../../components/comparison/ComparisonLayout"; const meta = { - title: "Keycloak vs. Auth0: The Open-Source Alternative (2026 Guide)", + title: "Keycloak vs. Auth0 — Phase Two", description: "A 2026 comparison of Keycloak vs. Auth0 — cost, deployment, maintenance, and features — and why managed Keycloak is a strong open-source alternative to Auth0.", keywords: "keycloak vs auth0, auth0 alternative, open source auth0 alternative, auth0 pricing, managed keycloak", }; -const heroIntro = ( - <> - Auth0 is a popular, fully managed cloud platform; Keycloak is the open-source alternative - that competes strongly on cost, control, and flexibility. Here's how the two compare across - cost of ownership, deployment, maintenance, and features — and why pairing Keycloak with a - managed host like Phase Two often gives you the best of both. - -); +const hero = { + variant: "C", + headline: <>Auth0's bill grows with you. Keycloak's doesn't., + lede: ( + <> + Auth0 is a popular, fully managed cloud platform. Keycloak is the open-source alternative that + competes strongly on cost, control, and flexibility — and pairing it with a managed host + like Phase Two often gives you the best of both. + + ), + secondaryCta: { label: "See the cost breakdown →", href: "#cost" }, + chart: { + title: "Annual identity spend vs. monthly active users", + xLabels: ["1k", "25k", "100k MAU"], + legendVendor: "Auth0 (per-MAU)", + ariaLabel: "Cost growth: Auth0 climbs, Keycloak stays flat", + }, +}; const atAGlance = [ - { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, - { dim: "Pricing driver", vendor: "Per monthly active user (MAU) + features", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, - { dim: "Cost predictability", vendor: "Scales with users and features", keycloak: "Predictable; decoupled from user growth" }, - { dim: "Deployment", vendor: "Cloud SaaS only", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, - { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, - { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML", keycloak: "OAuth 2.0, OIDC, SAML" }, - { dim: "Extensibility", vendor: "Actions framework (bounded)", keycloak: "Full source access + SPIs/extensions" }, - { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, + { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open-source (Apache 2.0), no license fee", check: true }, + { dim: "Pricing driver", vendor: "Per monthly active user (MAU) + features", keycloak: "Fixed infrastructure / hosting cost, not per-user", check: true }, + { dim: "Cost predictability", vendor: "Scales with users and features", keycloak: "Predictable, decoupled from user growth", check: true }, + { dim: "Deployment", vendor: "Cloud / SaaS only", keycloak: "Self-hosted, your cloud, on-premise, or managed", check: true }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location", check: true }, + { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML", keycloak: "SAML, OpenID Connect, OAuth 2.0" }, + { dim: "Extensibility", vendor: "Actions framework (bounded)", keycloak: "Full source access — SPI extensions, themes, custom code", check: true }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based", check: true }, ]; const sections = [ { + id: "cost", + kicker: "01 — TCO", title: "Cost of Ownership", body: ( <> -

- Auth0 operates on a subscription model that can be appealing for startups or small - projects. Its free tier is generous on paper — up to 25,000 monthly active users (MAU) — - but it's bounded on connections, organizations, and features, and most production - workloads quickly outgrow it. -

-

- Here's the catch: Auth0's list prices look modest until you map them to how a real - application actually uses the platform. As of 2026, Auth0's published pricing (per month, - billed monthly) scales like this: -

-
- - - - - - - - - - - - - - - -
Monthly active usersB2C EssentialsB2C ProfessionalB2B Essentials
1,000$70$240$300
5,000$350$1,000$1,300
10,000$700$1,600$2,100
20,000$1,400$3,200$3,800
-
-

- Figures reflect Auth0's published list pricing as of 2026 ( - auth0.com/pricing - ); Auth0 changes pricing periodically, so confirm current rates for your tier and region. -

-

Two things push the real bill well beyond the headline numbers:

-
    -
  • - The features you actually need live in higher tiers and add-ons. SAML, - LDAP/Active Directory federation, and log streaming move you up a band — and several - common needs are billed as separate line items. Additional enterprise SSO connections - run about $100/month each on B2B plans; MFA is a $100/month add-on on B2B - Essentials; machine-to-machine (M2M) tokens are metered separately (up to roughly - $1,200/month for 300,000 tokens); and the newer AI Agents add-on is priced at 50% of - your base subscription. -
    • -
  • - "Users" and "organizations" aren't cheap. If you sell to businesses, - Auth0's B2B model is the one that fits — and it costs materially more than B2C at the - same scale (for example, $3,800/month for B2B Essentials vs. $1,400/month for - B2C Essentials at 20,000 MAU). Organizations, enterprise connections, and - per-customer SSO all push the number up. -
    • -
-

- For anything beyond mid-size, Auth0 routes you into a custom Enterprise contract. In - practice those negotiations tend to land in the six figures annually — we routinely talk - to teams whose Auth0 quotes target $100K+ per year once SSO, MFA, - organizations, and log streaming are bundled in. The problem isn't that any single number - is outrageous; it's that the total is hard to predict and climbs with every feature and - every user you add. -

-

- Keycloak, by contrast, is free to use regardless of users or scale. The primary cost is - hosting and operating the software, which means your spend tends to be fixed, - driven by infrastructure rather than user counts or feature gates.{" "} - Winner: Keycloak. See a side-by-side{" "} - pricing estimate vs. Auth0. -

+

Auth0 operates on a subscription model that can be appealing for startups or small projects. Its free tier is generous on paper — up to 25,000 monthly active users (MAU) — but it's bounded on connections, organizations, and features, and most production workloads quickly outgrow it.

+

Here's the catch: Auth0's list prices look modest until you map them to how a real application actually uses the platform. As of 2026, Auth0's published pricing (per month, billed monthly) scales roughly like this:

+ + + + + + + + +
Monthly active usersB2C EssentialsB2B Essentials
1,000$70$300
5,000$350$1,300
10,000$700$2,100
20,000$1,400$3,800
+

Figures reflect Auth0's published list pricing as of 2026 (auth0.com/pricing); Auth0 changes pricing periodically — confirm current rates for your tier and region.

+

Two things push the real bill well beyond the headline numbers. First, the features you actually need live in higher tiers and add-ons — SAML and LDAP/Active Directory federation, log streaming, additional enterprise SSO connections (around $100/month each on B2B plans), metered M2M tokens, and the newer AI Agents add-on. Second, "users" and "organizations" aren't cheap: if you sell to businesses, Auth0's B2B model costs materially more than B2C at the same scale.

+

For anything beyond mid-size, Auth0 routes you into a custom Enterprise contract. In practice these negotiations tend to land in the six figures annually once SSO, MFA, organizations, and log streaming are bundled in. The problem isn't any single number — it's that the total is hard to predict and climbs with every feature and every user you add.

+

Keycloak, by contrast, is free to use regardless of users or scale. The primary cost is hosting and operating the software, which means your spend tends to be fixed — driven by infrastructure rather than user counts or feature gates.

+

Winner: Keycloak

+

Leveraging Phase Two's managed hosting keeps that spend predictable as you grow. See a side-by-side pricing estimate vs. Auth0.

), }, { - title: "Architecture and Deployment", + id: "architecture", + kicker: "02 — Deployment", + title: "Architecture & Deployment", body: ( <> -

- Auth0 is a cloud-based service, so there's little infrastructure to set up. That enables - quick deployment and removes much of the DevOps burden. The trade-off: enterprises with - strict regulatory or data-residency requirements often need on-premise options that a - SaaS-only model can't provide. -

-

- Keycloak can be deployed on-premise, in your own cloud, or via a{" "} - managed cloud service. Because you control the deployment - environment, it conforms to compliance and data-sovereignty needs.{" "} - Winner: Depends. If you need on-premise or strict data control, Keycloak - wins clearly — and it still gives you the flexibility to{" "} - self-host or use managed hosting. -

+

Auth0 is a cloud-based service, so there is little infrastructure to set up. That enables quick deployment and removes much of the DevOps burden. The trade-off is that enterprises with strict regulatory or data-residency requirements often need on-premise options that a SaaS-only model can't fully provide.

+

Keycloak can be deployed on-premise, in your own cloud, or via a managed cloud service. Because you control the deployment environment, it conforms to compliance and data-sovereignty needs and gives you greater control over your security and compliance standards.

+

Winner: Depends

+

If you need on-premise or strict data control, Keycloak wins clearly — and it still gives you the flexibility to self-host or use managed hosting.

), }, { + id: "maintenance", + kicker: "03 — Operations", title: "Maintenance", body: ( <> -

- As a managed service, Auth0 requires minimal maintenance from your side — it handles - updates, security patches, and infrastructure. -

-

- Self-hosted Keycloak requires more attention: installation, configuration, upgrades, and - the underlying infrastructure. Phase Two removes this trade-off entirely: with{" "} - managed hosting and{" "} - zero-downtime upgrades, you get - Keycloak's control without the operational load.{" "} - Winner: Auth0 for self-hosted Keycloak; a tie when Keycloak is managed by Phase - Two. -

+

As a managed service, Auth0 requires minimal maintenance from your side — it handles updates, security patches, and infrastructure.

+

Self-hosted Keycloak requires more attention: installation, configuration, upgrades, and the underlying infrastructure. Phase Two removes this trade-off entirely: with managed hosting and zero-downtime upgrades, you get Keycloak's control without the operational load.

+

Winner: Auth0 for self-hosted Keycloak — a tie when Keycloak is managed by Phase Two

), }, { - title: "Functionality and Flexibility", + id: "functionality", + kicker: "04 — Capability", + title: "Functionality & Flexibility", body: ( <> -

- Auth0 offers a broad set of authentication features out of the box — social logins, - enterprise federation, database connections — and supports OAuth 2.0, OpenID Connect, and - SAML. Customization happens through its Actions framework, which can become difficult to - manage as logic grows outside the main application. -

-

- Keycloak matches Auth0 on core functionality and the same protocols, with customizable - login, registration, and account-management UIs. Being open source, it lets developers - extend the codebase far more freely — a higher ceiling for customization. A standout - capability is Keycloak's on-premise deployment options.{" "} - Winner: Keycloak. The two are comparable on features, but Keycloak is far - more extensible and configurable. -

+

Auth0 offers a broad set of authentication features out of the box — social logins, enterprise federation, database connections — and supports OAuth 2.0, OpenID Connect, and SAML. Customization happens through its Actions framework, which can become difficult to manage as logic grows outside the main application.

+

Keycloak matches Auth0 on core functionality and the same protocols, with customizable login, registration, and account-management UIs. Being open source, it lets developers extend the codebase far more freely — a higher ceiling for customization. A standout capability is Keycloak's on-premise deployment options.

+

Winner: Keycloak

+

The two are comparable on features, but Keycloak is far more extensible and configurable.

), }, { + id: "integrating", + kicker: "05 — Interop", title: "Migrating from Auth0 to Keycloak", body: ( <> -

- Moving off Auth0 is more approachable than many teams expect. Keycloak imports users, - supports gradual cutover, and brokers identities so you can transition without disrupting - access — see Migrate to Keycloak. -

-

- You can also run Keycloak alongside Auth0 during a transition: Keycloak can act - as a broker that delegates authentication to an external IdP such as Auth0. That lets you - keep existing Auth0 connections while Keycloak handles internal permissions, roles, and a - consistent login experience — a low-risk path to migrating one piece at a time. -

+

Moving off Auth0 is more approachable than many teams expect. Keycloak imports users, supports gradual cutover, and brokers identities so you can transition without disrupting access — see Migrate to Keycloak.

+

You can also run Keycloak alongside Auth0 during a transition: Keycloak can act as a broker that delegates authentication to an external IdP such as Auth0. That lets you keep existing Auth0 connections while Keycloak handles internal permissions, roles, and a consistent login experience — a low-risk path to migrating one piece at a time.

+ + ), + }, + { + id: "best", + kicker: "06 — Verdict", + title: "Which IAM solution is best for me?", + body: ( + <> +

Choosing between Auth0 and Keycloak largely depends on your organization's needs. Auth0 is an excellent choice for teams that want a fully managed developer experience and are comfortable with per-MAU, per-feature costs. For organizations that prioritize cost savings and predictability, can manage their infrastructure, or require extensive customization, Keycloak emerges as a powerful, budget-friendly alternative.

+

Ultimately, we at Phase Two believe marrying the two together is the strongest match. We offer robust Keycloak hosting, migration, and support. Leveraging Keycloak means ongoing costs are relatively fixed, so concerns about user growth or feature needs don't have to factor into every decision.

), }, ]; +const matrix = { + savings: "~80%", + rows: [ + { feat: "Per-MAU pricing penalty", vendor: "$$$", keycloak: "lim" }, + { feat: "Open-source core", vendor: "no", keycloak: "yes" }, + { feat: "Self-hostable (no lock-in)", vendor: "no", keycloak: "yes" }, + { feat: "On-premise / data residency", vendor: "no", keycloak: "yes" }, + { feat: "Advanced features without add-on tiers", vendor: "$$$", keycloak: "yes" }, + { feat: "Custom SAML / OIDC IdPs", vendor: "yes", keycloak: "yes" }, + { feat: "Full source access & SPI extensions", vendor: "lim", keycloak: "yes" }, + { feat: "Federate / broker existing IdP", vendor: "lim", keycloak: "yes" }, + { feat: "24/7 escalation with Keycloak experts", vendor: "lim", keycloak: "yes" }, + ], +}; + const faqs = [ { q: "Is Keycloak a good alternative to Auth0?", - a: ( -

- Yes. Keycloak supports the same core standards as Auth0 (OAuth 2.0, OpenID Connect, SAML) - and matches it on most authentication and authorization features, while being open source - and free of per-user licensing. The main trade-off is operational overhead, which a managed - host like Phase Two removes. -

- ), - text: - "Yes. Keycloak supports the same core standards as Auth0 (OAuth 2.0, OpenID Connect, SAML) and matches it on most features, while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + a:

Yes. Keycloak supports the same core standards as Auth0 (OAuth 2.0, OpenID Connect, SAML) and matches it on most authentication and authorization features, while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.

, + text: "Yes. Keycloak supports the same core standards as Auth0 (OAuth 2.0, OpenID Connect, SAML) and matches it on most features, while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", }, { q: "Is Keycloak cheaper than Auth0?", - a: ( -

- For most growing applications, yes. Auth0 pricing scales with monthly active users and - feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely - fixed as your user base grows. Teams moving from Auth0 to managed Keycloak frequently see - substantial savings. -

- ), - text: - "For most growing applications, yes. Auth0 pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows.", + a:

For most growing applications, yes. Auth0 pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows. Teams moving from Auth0 to managed Keycloak frequently see substantial savings.

, + text: "For most growing applications, yes. Auth0 pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows.", }, { q: "Can I migrate from Auth0 to Keycloak?", - a: ( -

- Yes. Keycloak can import your users and broker authentication to Auth0 during a phased - cutover, so you can migrate incrementally without disrupting users. See{" "} - Migrate to Keycloak. -

- ), - text: - "Yes. Keycloak can import your users and broker authentication to Auth0 during a phased cutover, so you can migrate incrementally without disrupting users.", + a:

Yes. Keycloak can import your users and broker authentication to Auth0 during a phased cutover, so you can migrate incrementally without disrupting users. See Migrate to Keycloak.

, + text: "Yes. Keycloak can import your users and broker authentication to Auth0 during a phased cutover, so you can migrate incrementally without disrupting users.", }, { q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", - a: ( -

- Yes. Keycloak is built on these standards and interoperates with both modern applications - and legacy systems, including LDAP and Active Directory. -

- ), - text: - "Yes. Keycloak is built on these standards and interoperates with both modern applications and legacy systems, including LDAP and Active Directory.", + a:

Yes. Keycloak is built on these standards and interoperates with both modern applications and legacy systems, including LDAP and Active Directory.

, + text: "Yes. Keycloak is built on these standards and interoperates with both modern applications and legacy systems, including LDAP and Active Directory.", }, { q: "Can Keycloak be self-hosted or run on-premise?", - a: ( -

- Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This - flexibility is a key advantage over Auth0's cloud-only model, especially for data-residency - and compliance requirements. -

- ), - text: - "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over Auth0's cloud-only model, especially for data-residency and compliance requirements.", + a:

Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over Auth0's cloud-only model, especially for data-residency and compliance requirements.

, + text: "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over Auth0's cloud-only model, especially for data-residency and compliance requirements.", }, ]; +const migration = { + heading: "Already using Auth0?", + body: "Moving to Keycloak is more approachable than most teams expect. We import users, broker authentication during a phased cutover, and move you off Auth0 without disrupting access.", +}; + +const bigcta = { + heading: "See how much you'd save.", + body: "A 30-minute demo and a custom proposal — keyed to your current Auth0 contract — usually beats your renewal.", +}; + export default function KeycloakVsAuth0() { return ( ); } diff --git a/src/pages/keycloak-alternatives/frontegg.jsx b/src/pages/keycloak-alternatives/frontegg.jsx index f29256d7..cde6f51b 100644 --- a/src/pages/keycloak-alternatives/frontegg.jsx +++ b/src/pages/keycloak-alternatives/frontegg.jsx @@ -3,322 +3,197 @@ import React from "react"; import ComparisonLayout from "../../components/comparison/ComparisonLayout"; const meta = { - title: "Keycloak vs. FrontEgg: The Open-Source Alternative", + title: "Keycloak vs. FrontEgg — Phase Two", description: - "An in-depth comparison of Keycloak vs. FrontEgg — cost, deployment, customization, scalability, and support — and why open-source Keycloak is a strong alternative to FrontEgg's SaaS-focused user management platform.", + "A 2026 comparison of Keycloak vs. FrontEgg — cost, deployment, maintenance, and B2B features — and why managed Keycloak is a strong open-source alternative to FrontEgg.", keywords: - "keycloak vs frontegg, frontegg alternative, open source frontegg alternative, frontegg pricing, managed keycloak, b2b user management", + "keycloak vs frontegg, frontegg alternative, open source frontegg alternative, frontegg pricing, managed keycloak, b2b authentication", }; -const heroIntro = ( - <> - FrontEgg is a cloud-native platform built for embedded B2B user management in SaaS - applications; Keycloak is the open-source alternative that gives you the same authentication - and authorization capabilities with full control over cost, deployment, and customization. - Here's how the two compare — and why pairing Keycloak with a managed host like Phase Two often - gives you the best of both. - -); +const hero = { + variant: "C", + headline: <>FrontEgg charges per MAU. Keycloak charges per server., + lede: ( + <> + FrontEgg is an embedded B2B user-management platform billed on monthly active users with B2B + features gated by tier. Keycloak gives you the same B2B building blocks — organizations, roles, + SSO, self-service — priced on infrastructure, not per active user. + + ), + secondaryCta: { label: "See the cost breakdown →", href: "#cost" }, + chart: { + title: "Annual identity spend vs. monthly active users", + xLabels: ["1k", "25k", "100k MAU"], + legendVendor: "FrontEgg (per-MAU)", + ariaLabel: "Cost growth: FrontEgg climbs, Keycloak stays flat", + }, +}; const atAGlance = [ - { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, - { dim: "Pricing driver", vendor: "Per-feature tiers + usage; sales-gated above the entry plan", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, - { dim: "Cost predictability", vendor: "Scales with features and user volume", keycloak: "Predictable; decoupled from user growth" }, - { dim: "Deployment", vendor: "Cloud SaaS, no robust on-premise option", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, - { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, - { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML", keycloak: "OAuth 2.0, OIDC, SAML" }, - { dim: "Extensibility", vendor: "Bounded; plug-and-play, SaaS-focused", keycloak: "Full source access + SPIs/extensions" }, - { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, + { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open-source (Apache 2.0), no license fee", check: true }, + { dim: "Pricing driver", vendor: "Per-MAU tiers + B2B feature gating", keycloak: "Fixed infrastructure / hosting cost, not per-user", check: true }, + { dim: "Cost predictability", vendor: "Scales with MAU & feature tiers", keycloak: "Predictable, decoupled from user growth", check: true }, + { dim: "Deployment", vendor: "Cloud / SaaS only", keycloak: "Self-hosted, your cloud, on-premise, or managed", check: true }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location", check: true }, + { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML, SCIM", keycloak: "SAML, OpenID Connect, OAuth 2.0, SCIM", check: true }, + { dim: "Extensibility", vendor: "Embeddable widgets, bounded", keycloak: "Full source access — SPI extensions, themes, custom code", check: true }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based", check: true }, ]; const sections = [ { - title: "Cost Structure", - body: ( - <> -

- As an open-source solution, Keycloak is free to use, making it an attractive option for - organizations of all sizes. While there are no licensing fees, organizations need to - consider hosting costs and the resources required for system management. This cost model - makes Keycloak particularly appealing for startups and enterprises that can manage their - own infrastructure effectively. -

-

- FrontEgg operates on a subscription-based pricing model, starting with a free trial that - unlocks the platform's features. After the trial, paid plans require an ongoing - subscription, and pricing climbs as you adopt more capabilities. FrontEgg also offers a - generous "free forever" tier that gives you enough to evaluate the platform — but it isn't - intended for a production application with serious user commitments. Moving up is driven by - features and typically requires contacting sales to assess pricing. While the higher tiers - promise growth toward unlimited users, the cost is heavily dependent on usage. -

-

- While FrontEgg simplifies IAM implementation and reduces the development burden, - organizations must weigh the recurring, usage-driven costs against the value gained from - its streamlined user management.{" "} - Winner: Keycloak — a more economically advantageous option, particularly - for organizations with the technical capability to manage their own infrastructure. - Leverage Phase Two's hosting to test and integrate - authentication and authorization into your application(s), and see a side-by-side{" "} - pricing estimate. -

- - ), - }, - { - title: "Deployment Options", - body: ( - <> -

- Keycloak offers flexibility in deployment, supporting both on-premises and cloud-based - solutions. This capability allows organizations to maintain control over their identity - management infrastructure, making it suitable for varying operational requirements and - compliance needs. -

-

- FrontEgg is primarily a cloud-based solution designed for rapid deployment, offering a - plug-and-play experience that facilitates quick integration into existing applications. - While it doesn't provide robust on-premises capabilities, it excels in cloud environments, - catering particularly well to SaaS platforms aiming for fast time-to-market. -

-

- - Winner: Keycloak offers superior deployment flexibility, accommodating both complex - cloud and on-premises infrastructures. - {" "} - FrontEgg, however, excels in ease of use for cloud-based deployments. Keycloak still gives - you the choice to deploy on-premise or to{" "} - self-host or use managed hosting. -

- - ), - }, - { - title: "Customization and Branding", + id: "cost", + kicker: "01 — TCO", + title: "Cost of Ownership", body: ( <> -

- Keycloak is renowned for its extensive customization options, enabling organizations to - tailor authentication flows, user interfaces, and security protocols to meet their - specific needs. Its open-source nature allows for modifications that avoid vendor lock-in, - facilitating a user experience that matches organizational needs. While branding and - theming Keycloak is possible, doing so isn't always straightforward out of the box. Phase - Two has made this easier by extending the Keycloak Admin UI, a capability available across - all of its hosted offerings. -

-

- FrontEgg also provides customization capabilities but focuses on delivering a user-friendly - interface that prioritizes speed and accessibility. It allows basic branding and minor - adjustments but may not match the depth of customization available in Keycloak. The - branding tool FrontEgg built is well done and prioritizes the user experience. -

-

- Winner: Keycloak takes the lead in customization and flexibility, - providing organizations more granular control over user interfaces and workflows — while - FrontEgg leads with a strong user experience for branding customization. -

+

FrontEgg sells speed: drop-in login boxes, an admin portal, and B2B primitives like organizations and roles. The pricing follows the same B2B SaaS pattern as the platforms it serves — a free tier to start, then usage-based pricing that climbs on multiple axes at once: monthly active users, SSO/SCIM connections, and machine-to-machine (M2M) tokens.

+

As of 2026, FrontEgg's published pricing estimator scales roughly like this:

+ + + + + + + +
PlanPriceWhat's included
Free$0Up to 7,500 MAU to evaluate the platform
Pay as you goUsage-based (≈$2,490/mo at 18,000 MAU, 15 SSO/SCIM connections, 190 M2M tokens)Hosted login, 5 enterprise connections, unlimited orgs, custom domain
EnterpriseCustomAdd-ons, multiple environments, advanced fraud protection, 99.99% SLA
+

Figures reflect FrontEgg's published pricing estimator as of 2026 (frontegg.com/pricing); the pay-as-you-go figure is an example at one slider configuration, not a flat rate — your cost moves with MAU, connections, and M2M tokens. Enterprise is quote-based.

+

The catch is the same one every per-MAU platform shares, multiplied across three axes. The pay-as-you-go bill rises with your monthly active users, with each additional SSO/SCIM connection, and with the volume of M2M tokens you issue — so success makes it more expensive on three fronts at once. And the most advanced capabilities — multiple environments, advanced fraud protection, and a 99.99% SLA — sit behind a custom Enterprise contract rather than a published price.

+

Keycloak provides the same B2B building blocks — multi-tenant organizations, fine-grained roles, SSO, and self-service flows (Phase Two maintains the widely used Organizations extension) — with no per-MAU charge, no per-connection metering, and no M2M token billing. Your cost tracks infrastructure, not signups.

+

Winner: Keycloak

+

With Phase Two managed hosting, growth in active users doesn't change your bill. See a side-by-side pricing estimate vs. FrontEgg.

), }, { - title: "Scalability and Performance", + id: "architecture", + kicker: "02 — Deployment", + title: "Architecture & Deployment", body: ( <> -

- Keycloak is designed for high scalability, accommodating large user bases through - horizontal scaling and clustered deployments. This architecture makes it suitable for - extensive enterprise environments that require robust performance under varying loads. -

-

- FrontEgg is also built with scalability in mind, catering to growing SaaS applications - through its multi-tenant architecture. While it's designed to manage increasing user - volumes effectively, its performance may not yet match Keycloak's capabilities in - extremely large-scale environments. -

-

- - Winner: Keycloak is the preferred option for larger applications requiring robust - scalability. - {" "} - However, FrontEgg is well-suited for rapidly growing applications, especially in the SaaS - space. -

+

FrontEgg is a cloud-based service, so there is little infrastructure to set up. That enables quick deployment and removes much of the DevOps burden. The trade-off is that enterprises with strict regulatory or data-residency requirements often need on-premise options that a SaaS-only model can't fully provide.

+

Keycloak can be deployed on-premise, in your own cloud, or via a managed cloud service. Because you control the deployment environment, it conforms to compliance and data-sovereignty needs and gives you greater control over your security and compliance standards.

+

Winner: Depends

+

If you need on-premise or strict data control, Keycloak wins clearly — and it still gives you the flexibility to self-host or use managed hosting.

), }, { - title: "Functionality and Flexibility", + id: "maintenance", + kicker: "03 — Operations", + title: "Maintenance", body: ( <> -

- Keycloak provides a comprehensive suite of IAM features, including various authentication - methods, fine-grained access control, and advanced identity federation capabilities. Its - versatility in integrating with existing infrastructures makes Keycloak a powerful solution - for complex IAM scenarios. -

-

- FrontEgg focuses on user management, facilitating seamless authentication and role - management. Its end-to-end user management platform integrates easily with existing - applications, offering a robust alternative for companies seeking quick implementation - without extensive customization. -

-

- Winner: Keycloak leads in functionality and versatility, offering a - broader range of advanced IAM features, making it a better choice for diverse security - needs. Phase Two can provide expert enterprise help, custom development, and{" "} - migrations. -

+

A strong advantage of FrontEgg is that it's a managed service. From a DevOps perspective, it requires minimal maintenance — the FrontEgg team handles updates, security patches, and infrastructure, keeping the system up to date. This comes at a cost, though, since customization is comparatively limited.

+

Self-hosted Keycloak requires more attention: organizations must allocate resources for installing, configuring, and updating the software, as well as managing the underlying infrastructure. This can be a drawback for teams without the necessary expertise. Phase Two removes this trade-off entirely: with managed hosting and zero-downtime upgrades, you get Keycloak's control without the operational load.

+

Winner: FrontEgg for self-hosted Keycloak — a tie when Keycloak is managed by Phase Two

), }, { - title: "Integration Capabilities", + id: "functionality", + kicker: "04 — Capability", + title: "Functionality & Flexibility", body: ( <> -

- Keycloak's extensive integration capabilities include support for various identity - providers and protocols like SAML, OAuth 2.0, and OpenID Connect. This allows - organizations to leverage existing systems while enabling seamless authentication across - applications. -

-

- FrontEgg also supports a wide range of integrations but primarily focuses on simplifying - connections for SaaS applications. Its plug-and-play approach makes it easy to incorporate - into existing products but may lack the depth of integration options available in Keycloak. -

-

- Winner: Keycloak emerges as the more versatile option, providing greater - flexibility for organizations with complex integration requirements. FrontEgg offers a - great and easy interface to integrate with the providers and protocols it supports. -

+

FrontEgg is strong at embedded B2B UX: prebuilt login and admin components, organizations, role-based access, and self-service that teams can ship quickly. Its model is to own the user-management layer of your app through its widgets and APIs.

+

Keycloak covers the same B2B primitives — multi-tenant organizations, RBAC and ABAC, SSO, MFA, and self-service registration and account management — with fully themeable, embeddable login flows. Because it's open source, you can extend any of it, and you own the user data outright.

+

Winner: Keycloak

+

FrontEgg gets you live fast; Keycloak gives you the same capabilities without per-user cost and with a far higher customization ceiling.

), }, { - title: "Community and Support", + id: "integrating", + kicker: "05 — Interop", + title: "Integrating Keycloak with external systems like FrontEgg", body: ( <> -

- Keycloak benefits from a robust open-source community, with extensive documentation, - forums, and active user contributions. Organizations can rely on community-driven support - and resources to troubleshoot issues and share best practices. -

-

- FrontEgg provides dedicated customer support along with a library of resources. While still - relatively new, it focuses on delivering good customer experiences and support for its - users. Much of FrontEgg's Enterprise tier is focused on providing that support. -

-

- - Winner: Keycloak's established community offers a good way to get answers and help. - {" "} - FrontEgg's support channels are only available with the right license. Phase Two helps fill - the gap between community help and Enterprise support — see{" "} - how we support and migrate teams to Keycloak. -

+

For organizations looking to transition from FrontEgg to Keycloak — or to integrate Keycloak with systems already using FrontEgg — Keycloak's flexibility offers a significant advantage. Keycloak can act as a broker that sits between FrontEgg and your applications, letting you leverage the strengths of both platforms during a transition.

+

Keycloak's identity-brokering capability lets it delegate authentication to external identity providers (IdPs) such as FrontEgg. Keycloak can manage internal permissions and roles, provide additional security checks, and maintain a consistent, user-friendly login experience across systems. This makes migrating off FrontEgg a low-risk, phased process — you can move one piece at a time without disrupting user access or security.

), }, { - title: "How Should I Choose an IAM?", + id: "best", + kicker: "06 — Verdict", + title: "Which IAM solution is best for me?", body: ( <> -

- Choosing the right IAM solution depends on your organization's specific needs and strategic - goals. Keycloak is ideal for those seeking a customizable, open-source platform with - extensive features and deployment flexibility. FrontEgg, with its focus on rapid - implementation and simplicity for SaaS applications, is a compelling option for tech - companies looking to reduce development time and overhead. -

-

- If you're looking to explore Keycloak further or have questions about{" "} - integrating it into your organization,{" "} - reach out for assistance. The right IAM solution can - help you secure your digital environment and streamline user management effectively. -

+

FrontEgg is a good fit for early B2B teams that want embedded user management shipped in days and don't yet feel the per-MAU cost. As active users and B2B feature needs grow, Keycloak becomes the more economical and flexible choice — and it removes the ceiling on customization and data ownership.

+

Phase Two runs Keycloak for you, pairing the B2B building blocks FrontEgg is known for with open standards, full data ownership, and a fixed, predictable cost.

), }, ]; +const matrix = { + savings: "~80%", + rows: [ + { feat: "Per-MAU pricing penalty", vendor: "$$$", keycloak: "lim" }, + { feat: "Open-source core", vendor: "no", keycloak: "yes" }, + { feat: "Self-hostable (no lock-in)", vendor: "no", keycloak: "yes" }, + { feat: "On-premise / data residency", vendor: "no", keycloak: "yes" }, + { feat: "B2B orgs & roles without tier gating", vendor: "$$$", keycloak: "yes" }, + { feat: "Custom SAML / OIDC IdPs & SCIM", vendor: "yes", keycloak: "yes" }, + { feat: "Full source access & SPI extensions", vendor: "lim", keycloak: "yes" }, + { feat: "Federate / broker existing IdP", vendor: "lim", keycloak: "yes" }, + { feat: "24/7 escalation with Keycloak experts", vendor: "lim", keycloak: "yes" }, + ], +}; + const faqs = [ { q: "Is Keycloak a good alternative to FrontEgg?", - a: ( -

- Yes. Keycloak supports the same core standards as FrontEgg (OAuth 2.0, OpenID Connect, SAML) - and provides a comprehensive set of authentication and authorization features, while being - open source and free of subscription licensing. FrontEgg excels at plug-and-play B2B user - management for SaaS, but Keycloak offers deeper customization, deployment flexibility, and - lower long-term cost. -

- ), - text: - "Yes. Keycloak supports the same core standards as FrontEgg (OAuth 2.0, OpenID Connect, SAML) and provides a comprehensive set of features, while being open source and free of subscription licensing. FrontEgg excels at plug-and-play B2B user management for SaaS, but Keycloak offers deeper customization, deployment flexibility, and lower long-term cost.", + a:

Yes. Keycloak provides the same B2B building blocks — organizations, roles, SSO, MFA, and self-service — on open standards, while being open source and free of per-MAU licensing. Phase Two maintains the popular Organizations extension used for multi-tenant B2B.

, + text: "Yes. Keycloak provides the same B2B building blocks — organizations, roles, SSO, MFA, and self-service — on open standards, while being open source and free of per-MAU licensing. Phase Two maintains the popular Organizations extension used for multi-tenant B2B.", }, { q: "Is Keycloak cheaper than FrontEgg?", - a: ( -

- For most organizations that can manage their own infrastructure, yes. FrontEgg uses a - subscription model where cost is driven by features and usage and often requires a sales - conversation as you grow. Keycloak has no licensing fees — your cost is hosting and - operations, which stays largely fixed as your user base grows. -

- ), - text: - "For most organizations that can manage their own infrastructure, yes. FrontEgg uses a subscription model where cost is driven by features and usage. Keycloak has no licensing fees — your cost is hosting and operations, which stays largely fixed as your user base grows.", + a:

For growing B2B products, usually. FrontEgg bills per monthly active user with features gated by tier, so cost rises with success. Keycloak is priced on infrastructure and stays largely fixed as your user base grows.

, + text: "For growing B2B products, usually. FrontEgg bills per monthly active user with features gated by tier, so cost rises with success. Keycloak is priced on infrastructure and stays largely fixed as your user base grows.", }, { - q: "Can Keycloak be self-hosted or run on-premise?", - a: ( -

- Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This is a key - advantage over FrontEgg, which is primarily a cloud-based SaaS without robust on-premises - capabilities — making Keycloak the better fit for data-residency and compliance requirements. -

- ), - text: - "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This is a key advantage over FrontEgg, which is primarily a cloud-based SaaS without robust on-premises capabilities.", + q: "Can I migrate from FrontEgg to Keycloak?", + a:

Yes. Keycloak can import users and broker authentication during a phased cutover, so you can move tenants across incrementally without disrupting access. See Migrate to Keycloak.

, + text: "Yes. Keycloak can import users and broker authentication during a phased cutover, so you can move tenants across incrementally without disrupting access.", }, { - q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", - a: ( -

- Yes. Keycloak is built on these standards and supports a wide range of identity providers, - allowing organizations to leverage existing systems while enabling seamless authentication - across applications. -

- ), - text: - "Yes. Keycloak is built on these standards and supports a wide range of identity providers, allowing organizations to leverage existing systems while enabling seamless authentication across applications.", + q: "Does Keycloak support multi-tenant organizations?", + a:

Yes. Keycloak supports organizations and multi-tenancy, and Phase Two maintains a widely used Organizations extension plus fine-grained roles and permissions for B2B use cases.

, + text: "Yes. Keycloak supports organizations and multi-tenancy, and Phase Two maintains a widely used Organizations extension plus fine-grained roles and permissions for B2B use cases.", }, { - q: "How customizable is Keycloak compared to FrontEgg?", - a: ( -

- Keycloak is far more customizable. You can tailor authentication flows, user interfaces, and - security protocols, and because it's open source you can modify the codebase directly to - avoid vendor lock-in. FrontEgg offers a polished, user-friendly branding experience but more - limited depth. Phase Two makes Keycloak customization easier by extending the Admin UI across - its hosted offerings. -

- ), - text: - "Keycloak is far more customizable. You can tailor authentication flows, user interfaces, and security protocols, and because it's open source you can modify the codebase directly to avoid vendor lock-in. FrontEgg offers a polished branding experience but more limited depth.", + q: "Can Keycloak be self-hosted or run on-premise?", + a:

Yes. Keycloak runs on-premise, in your own cloud, or as a managed service — a key advantage over FrontEgg's cloud-only model for data-residency and compliance.

, + text: "Yes. Keycloak runs on-premise, in your own cloud, or as a managed service — a key advantage over FrontEgg's cloud-only model for data-residency and compliance.", }, ]; +const migration = { + heading: "Already using FrontEgg?", + body: "Moving to Keycloak is more approachable than most teams expect. We import users, broker authentication during a phased cutover, and move you off FrontEgg without disrupting access.", +}; + +const bigcta = { + heading: "See how much you'd save.", + body: "A 30-minute demo and a custom proposal — keyed to your current FrontEgg contract — usually beats your renewal.", +}; + export default function KeycloakVsFrontEgg() { return ( ); } diff --git a/src/pages/keycloak-alternatives/okta.jsx b/src/pages/keycloak-alternatives/okta.jsx index d0fd5cc2..1d144062 100644 --- a/src/pages/keycloak-alternatives/okta.jsx +++ b/src/pages/keycloak-alternatives/okta.jsx @@ -3,282 +3,203 @@ import React from "react"; import ComparisonLayout from "../../components/comparison/ComparisonLayout"; const meta = { - title: "Keycloak vs. Okta: The Open-Source Alternative", + title: "Keycloak vs. Okta — Phase Two", description: - "An in-depth comparison of Keycloak vs. Okta — cost of ownership, deployment, maintenance, and features — and why managed Keycloak is a strong open-source alternative to Okta.", + "A 2026 comparison of Keycloak vs. Okta — cost, deployment, maintenance, and features — and why managed Keycloak is a strong open-source alternative to Okta.", keywords: - "keycloak vs okta, okta alternative, open source okta alternative, okta pricing, managed keycloak, okta sso alternative", + "keycloak vs okta, okta alternative, open source okta alternative, okta pricing, managed keycloak", }; -const heroIntro = ( - <> - Okta is a leading cloud-based IAM provider that promises quick deployment and comprehensive - SSO and security features through a subscription service. Keycloak is the open-source - alternative that competes strongly on cost, control, and flexibility. Here's how the two - compare across cost of ownership, deployment, maintenance, and features — and why pairing - Keycloak with a managed host like Phase Two often gives you the best of both. - -); +const hero = { + variant: "A", + headline: ( + <> + You don't need Okta.
You need managed Keycloak. + + ), + lede: ( + <> + Okta is a leading cloud IAM provider that promises quick deployment and comprehensive SSO through a + subscription. Keycloak is the open-source alternative that competes hard on cost, control, and flexibility{" "} + — and pairing it with a managed host like Phase Two often gives you the best of both. + + ), + secondaryCta: { label: "See the comparison →", href: "#glance" }, + savingsPill: ( + <> + Teams switching off per-user pricing recover up to ~80% of identity spend + + ), +}; const atAGlance = [ - { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, - { dim: "Pricing driver", vendor: "Per-user + per-feature subscription", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, - { dim: "Cost predictability", vendor: "Scales with users and features; can balloon at enterprise scale", keycloak: "Predictable; decoupled from user growth" }, - { dim: "Deployment", vendor: "Cloud SaaS only", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, - { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, + { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open-source (Apache 2.0), no license fee", check: true }, + { dim: "Pricing driver", vendor: "Per-user, per-feature — advanced tiers quote-only", keycloak: "Fixed infrastructure / hosting cost, not per-user", check: true }, + { dim: "Cost predictability", vendor: "Bundles & feature tiers can balloon at scale", keycloak: "Predictable, decoupled from user growth", check: true }, + { dim: "Deployment", vendor: "Cloud / SaaS only", keycloak: "Self-hosted, your cloud, on-premise, or managed", check: true }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location", check: true }, { dim: "Standards", vendor: "SAML, OpenID Connect, OAuth 2.0", keycloak: "SAML, OpenID Connect, OAuth 2.0" }, - { dim: "Extensibility", vendor: "Limited customization", keycloak: "Full source access + SPIs/extensions, themes, custom code" }, - { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, + { dim: "Extensibility", vendor: "Limited customization", keycloak: "Full source access — SPI extensions, themes, custom code", check: true }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based", check: true }, ]; const sections = [ { + id: "cost", + kicker: "01 — TCO", title: "Cost of Ownership", body: ( <> -

- When evaluating IAM solutions, both upfront cost and total cost of ownership (TCO) - matter. Okta operates on a subscription-based pricing model, with costs varying based on - the number of users and the features you select. As a SaaS solution, it bundles - infrastructure, maintenance, and support into its subscription fees, which reduces - internal IT burden — Okta handles updates, patches, and system maintenance. -

-

- The catch is that per-user costs add up, especially for larger organizations. With every - feature enabled, the per-user cost grows significantly, and bills can climb into - enterprise bands quickly. While Okta provides scalability, letting businesses grow without - worrying about infrastructure investments, the costs that are incurred can balloon far - beyond the original projections and become a large piece of overall IT spend. -

-

- Keycloak, by contrast, is an open-source solution developed by Red Hat and is free to use - regardless of the number of users or the scale of the project. There are no licensing - fees. It does, however, require infrastructure to{" "} - host and run the application — cloud services or on-premise - hardware — plus resources to maintain, update, and customize it. The primary cost comes - from self-hosting and managing the software, which means your spend tends to be{" "} - fixed: it's driven by infrastructure rather than by features or user - counts. -

-

- Winner: Keycloak. Leveraging Phase Two's{" "} - managed hosting provides a more capable free tier to test and - integrate authentication and authorization into your applications. As an application's - needs grow for users and integrations, Keycloak quickly becomes a far more cost-effective - choice. See a side-by-side{" "} - pricing estimate. -

+

When evaluating IAM solutions, both upfront cost and total cost of ownership (TCO) matter. Okta operates on a subscription-based pricing model, with costs varying based on the number of users and the features you select. As a SaaS solution, it bundles infrastructure, maintenance, and support into its subscription fees — which reduces internal IT burden, since Okta handles upgrades, patches, and system maintenance.

+

As of 2026, Okta's published Workforce Identity (Okta Platform) plans are billed per user, per month:

+ + + + + + + + + +
PlanPrice (per user / mo)Highlights
Starter$6SSO, MFA, Universal Directory, 5 Workflows
Core Essentials$14Adds automation & security
Essentials$17Adaptive MFA, Lifecycle Mgmt, Access Governance, 50 Workflows
ProfessionalQuote onlyDevice Access, ITP, Sandbox
EnterpriseQuote onlyAPI Access Management, Access Gateway, M2M tokens
+

Figures reflect Okta's published Workforce Identity list pricing as of 2026 (link to okta.com/pricing); typically billed annually with minimums. Many enterprise features (Device Access, API Access Management, Access Gateway, ITP) are add-ons even on Essentials, and customer-identity (CIAM) is priced separately on the Auth0 platform.

+

The catch is what those headline per-user numbers leave out. Many of the capabilities teams actually need — Device Access, API Access Management, Secure Partner Access, Access Gateway, Identity Threat Protection, and Identity Security Posture Management — are add-ons even on the Essentials plan, and the most advanced tiers are quote-only. Workflows are capped, and privileged access is limited by plan. With every feature and every user added, the per-user cost grows significantly, and a bill can balloon far beyond the original projections to become a large slice of overall IT spend.

+

Keycloak, by contrast, is an open-source solution developed by Red Hat and is free to use regardless of the number of users or the scale of the project. There are no licensing fees. It does, however, require infrastructure to host and run the application — cloud services or on-premise hardware — plus resources to maintain, update, and customize it. The primary cost comes from self-hosting and managing the software, which means your spend tends to be fixed: it's driven by infrastructure rather than by features or user counts.

+

Winner: Keycloak

+

Leveraging Phase Two's managed hosting provides a more capable, cost-conscious way to run, test, and integrate authentication and authorization into your applications. As an application's needs grow for users and integrations, Keycloak quickly becomes a far more cost-effective choice. See a side-by-side pricing estimate.

), }, { - title: "Architecture and Deployment", + id: "architecture", + kicker: "02 — Deployment", + title: "Architecture & Deployment", body: ( <> -

- Okta is a cloud-based service, so there is little infrastructure to set up. That enables - quick deployment and removes much of the DevOps burden. The trade-off is that enterprises - with strict regulatory or data-residency requirements often need on-premise options that a - SaaS-only model can't provide. -

-

- Keycloak can be deployed on-premise, in your own cloud, - or via a managed cloud service. Because you control the - deployment environment, it conforms to compliance and data-sovereignty needs and gives you - greater control over security standards.{" "} - Winner: Depends. If you need on-premise or strict data control, Keycloak - wins clearly — and it still gives you the flexibility to{" "} - self-host or use managed hosting. -

+

Okta is a cloud-based service, so there is little infrastructure to set up. That enables quick deployment and removes much of the DevOps burden. The trade-off is that enterprises with strict regulatory or data-residency requirements often need on-premise options that a SaaS-only model can't provide.

+

Keycloak can be deployed on-premise, in your own cloud, or via a managed cloud service. Because you control the deployment environment, it conforms to compliance and data-sovereignty needs and gives you greater control over your security and compliance standards.

+

Winner: Depends

+

If you need on-premise or strict data control, Keycloak wins clearly — and it still gives you the flexibility to self-host or use managed hosting.

), }, { + id: "maintenance", + kicker: "03 — Operations", title: "Maintenance", body: ( <> -

- A strong advantage of Okta is that it is a managed service. From a DevOps perspective, it - requires minimal maintenance — the Okta team handles updates, security patches, and - infrastructure, keeping the system up to date. This comes at a cost, though, since - customization of Okta is limited. -

-

- Self-hosted Keycloak requires more attention: organizations must allocate resources for - installing, configuring, and updating the software, as well as managing the underlying - infrastructure. This can be a drawback for teams without the necessary technical expertise. - Phase Two removes this trade-off entirely: with{" "} - managed hosting and{" "} - zero-downtime upgrades, you get - Keycloak's control without the operational load.{" "} - Winner: Okta for self-hosted Keycloak; a tie when Keycloak is managed by Phase - Two. -

+

A strong advantage of Okta is that it's a managed service. From a DevOps perspective, it requires minimal maintenance — the Okta team handles updates, security patches, and infrastructure, keeping the system up to date. This comes at a cost, though, since customization of Okta is limited.

+

Self-hosted Keycloak requires more attention: organizations must allocate resources for installing, configuring, and updating the software, as well as managing the underlying infrastructure. This can be a drawback for teams without the necessary technical expertise. Phase Two removes this trade-off entirely: with managed hosting and zero-downtime upgrades, you get Keycloak's control without the operational load.

+

Winner: Okta for self-hosted Keycloak — a tie when Keycloak is managed by Phase Two

), }, { - title: "Functionality and Flexibility", + id: "functionality", + kicker: "04 — Capability", + title: "Functionality & Flexibility", body: ( <> -

- Okta's authentication mechanisms support multiple methods for enhanced security and user - convenience. Its authorization capabilities include role-based access control (RBAC) and - policy management, and it supports identity federation through SAML, OpenID Connect, and - other standards. Single sign-on (SSO) ensures a seamless experience across applications, - and Okta's user management features include self-service registration, account recovery, - and a comprehensive directory. Okta also offers extensive APIs, pre-built integrations, - detailed analytics and logging, and automated lifecycle management for provisioning and - deprovisioning. -

-

- Keycloak offers a comprehensive suite of features that is at parity with — or better than — - Okta in many ways. It provides multiple authentication methods, including - username/password, social logins, and multi-factor authentication (MFA). It supports - fine-grained authorization through RBAC and attribute-based access control (ABAC), excels - at identity federation via SAML and OpenID - Connect, and delivers SSO across multiple applications. Its user management covers - registration, password policies, and account linking, and the platform is highly - customizable through themes, custom code, and extensive configuration options, backed by - strong community support and a wide range of extensions. -

-

- A key point: the features that Okta and Auth0 cover somewhat separately are all covered by - a single Keycloak deployment.{" "} - Winner: Keycloak. The two offer much of the same authentication and - authorization functionality, but Keycloak is extremely flexible to extend and configure — - a system that can adjust and grow with an application — and it centralizes more use cases - without distinctions between separate products. -

+

Okta's authentication mechanisms support multiple methods for enhanced security and user convenience. Its authorization capabilities include role-based access control (RBAC) and policy management, and it supports identity federation through SAML, OpenID Connect, and other standards. Single sign-on (SSO) ensures a seamless experience across sign-on options, and Okta's user-management features include self-service registration, account recovery, and a comprehensive directory. Okta also offers extensive APIs, pre-built integrations, detailed analytics and logging, and automated lifecycle management for provisioning and deprovisioning.

+

Keycloak offers a comprehensive suite of features that is at parity with — or better than — Okta in many ways. It provides multiple authentication methods, including username/password, social logins, and multi-factor authentication (MFA). It supports fine-grained authorization through RBAC and attribute-based access control (ABAC), excels at identity federation via SAML and OpenID Connect, and delivers SSO across multiple applications. Its user management covers registration, password policies, and account linking, and the platform is highly customizable through themes, custom code, and extensive configuration options — backed by strong community support and a wide range of extensions.

+

A key point: the features that Okta and Auth0 cover somewhat separately are all covered by a single Keycloak deployment.

+

Winner: Keycloak

+

The two offer much of the same authentication and authorization functionality, but Keycloak is extremely flexible to extend and configure — a system that can adjust and grow with an application — and it centralizes more use cases without distinctions between separate products.

), }, { - title: "Integrating Keycloak with External Systems like Okta", + id: "integrating", + kicker: "05 — Interop", + title: "Integrating Keycloak with external systems like Okta", body: ( <> -

- For organizations looking to transition from Okta to Keycloak — or to integrate Keycloak - with systems already using Okta — Keycloak's flexibility offers significant advantages. - Keycloak can be configured to act as a broker that sits between Okta and your applications, - letting you leverage the strengths of both platforms. For example, an organization can use - Okta for external user management due to its robust third-party integrations while using - Keycloak to handle more sensitive internal authentication needs. -

-

- Keycloak's identity brokering capability lets it delegate authentication to external - identity providers (IdPs) such as Okta. Keycloak can manage internal permissions and - roles, provide additional security checks, and maintain a consistent, user-friendly login - experience across systems. This makes migrating - off Okta a low-risk, phased process — you can move one piece at a time without - disrupting user access or security. -

+

For organizations looking to transition from Okta to Keycloak — or to integrate Keycloak with systems already using Okta — Keycloak's flexibility offers a significant advantage. Keycloak can be configured to act as a broker that sits between Okta and your applications, letting you leverage the strengths of both platforms. For example, an organization can use Okta for external user management due to its robust third-party integrations, while using Keycloak to handle more sensitive internal authentication needs.

+

Keycloak's identity-brokering capability lets it delegate authentication to external identity providers (IdPs) such as Okta. Keycloak can manage internal permissions and roles, provide additional security checks, and maintain a consistent, user-friendly login experience across systems. This makes migrating off Okta a low-risk, phased process — you can move one piece at a time without disrupting user access or security.

), }, { - title: "Which IAM Solution Is Best for Me?", + id: "best", + kicker: "06 — Verdict", + title: "Which IAM solution is best for me?", body: ( <> -

- Choosing between Okta and Keycloak largely depends on your organization's specific needs - and capabilities. Okta is an excellent choice for those who need a fully managed solution - with costs linked to user numbers and features. For organizations that prioritize cost - savings and predictability, have the capability to manage their infrastructure, or require - extensive customization, Keycloak emerges as a powerful, budget-friendly alternative. Both - platforms offer extensive documentation and community support. -

-

- Ultimately, we at Phase Two believe marrying the two together is the strongest match. We - offer robust Keycloak hosting,{" "} - migration, and support options that fit - businesses of multiple sizes. Coupling the capabilities of Keycloak with the advantages of - a managed service translates directly to implementation and cost control across SSO, - authentication, authorization, user management, and more.{" "} - Leveraging Keycloak means that ongoing costs are relatively fixed, since - concerns about user growth or feature needs don't have to factor into every decision. -

+

Choosing between Okta and Keycloak largely depends on your organization's specific needs and capabilities. Okta is an excellent choice for those who need a fully managed solution and are comfortable with per-user, per-feature costs. For organizations that prioritize cost savings and predictability, have the capability to manage their infrastructure, or require extensive customization, Keycloak emerges as a powerful, budget-friendly alternative — backed by extensive documentation and community support.

+

Ultimately, we at Phase Two believe marrying the two together is the strongest match. We offer robust Keycloak hosting, migration, and support options that fit businesses of multiple sizes. Coupling the capabilities of Keycloak with the advantages of a managed service translates directly to implementation and cost control across SSO, authentication, authorization, user management, and more. Leveraging Keycloak means that ongoing costs are relatively fixed, so concerns about user growth or feature needs don't have to factor into every decision.

), }, ]; +const matrix = { + savings: "~80%", + rows: [ + { feat: "Per-user pricing penalty", vendor: "$$$", keycloak: "lim" }, + { feat: "Open-source core", vendor: "no", keycloak: "yes" }, + { feat: "Self-hostable (no lock-in)", vendor: "no", keycloak: "yes" }, + { feat: "On-premise / data residency", vendor: "no", keycloak: "yes" }, + { feat: "Advanced features without add-on tiers", vendor: "$$$", keycloak: "yes" }, + { feat: "Custom SAML / OIDC IdPs", vendor: "yes", keycloak: "yes" }, + { feat: "Full source access & SPI extensions", vendor: "lim", keycloak: "yes" }, + { feat: "Federate / broker existing IdP (de-risk migration)", vendor: "lim", keycloak: "yes" }, + { feat: "24/7 escalation with Keycloak experts", vendor: "lim", keycloak: "yes" }, + ], +}; + const faqs = [ { q: "Is Keycloak a good alternative to Okta?", - a: ( -

- Yes. Keycloak supports the same core standards as Okta (SAML, OpenID Connect, OAuth 2.0) and - matches it on most authentication and authorization features — SSO, MFA, federation, RBAC, - and user management — while being open source and free of per-user licensing. The main - trade-off is operational overhead, which a managed host like Phase Two removes. -

- ), - text: - "Yes. Keycloak supports the same core standards as Okta (SAML, OpenID Connect, OAuth 2.0) and matches it on most authentication and authorization features — SSO, MFA, federation, RBAC, and user management — while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + a:

Yes. Keycloak supports the same core standards as Okta (SAML, OpenID Connect, OAuth 2.0) and matches it on most authentication and authorization features — SSO, MFA, federation, RBAC, and user management — while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.

, + text: "Yes. Keycloak supports the same core standards as Okta (SAML, OpenID Connect, OAuth 2.0) and matches it on most authentication and authorization features — SSO, MFA, federation, RBAC, and user management — while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", }, { q: "Is Keycloak cheaper than Okta?", - a: ( -

- For most growing organizations, yes. Okta pricing scales with the number of users and the - features you enable, and costs can balloon at enterprise scale. Keycloak's cost is driven by - hosting infrastructure and stays largely fixed as your user base grows, so teams moving from - Okta to managed Keycloak frequently see substantial savings. -

- ), - text: - "For most growing organizations, yes. Okta pricing scales with the number of users and the features you enable, and costs can balloon at enterprise scale. Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows, so teams moving from Okta to managed Keycloak frequently see substantial savings.", + a:

For most growing organizations, yes. Okta pricing scales with the number of users and the features you enable, and costs can balloon at enterprise scale. Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows, so teams moving from Okta to managed Keycloak frequently see substantial savings.

, + text: "For most growing organizations, yes. Okta pricing scales with the number of users and the features you enable, and costs can balloon at enterprise scale. Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows, so teams moving from Okta to managed Keycloak frequently see substantial savings.", }, { q: "Can I migrate from Okta to Keycloak?", - a: ( -

- Yes. Keycloak can act as a broker that delegates authentication to Okta during a phased - cutover, so you can migrate incrementally — using Okta for some flows while Keycloak handles - internal permissions and roles — without disrupting users. See{" "} - Migrate to Keycloak. -

- ), - text: - "Yes. Keycloak can act as a broker that delegates authentication to Okta during a phased cutover, so you can migrate incrementally — using Okta for some flows while Keycloak handles internal permissions and roles — without disrupting users.", + a:

Yes. Keycloak can act as a broker that delegates authentication to Okta during a phased cutover, so you can migrate incrementally — using Okta for some flows while Keycloak handles internal permissions and roles — without disrupting users. See Migrate to Keycloak.

, + text: "Yes. Keycloak can act as a broker that delegates authentication to Okta during a phased cutover, so you can migrate incrementally — using Okta for some flows while Keycloak handles internal permissions and roles — without disrupting users.", }, { q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", - a: ( -

- Yes. Keycloak is built on these standards and excels at identity federation, interoperating - with both modern applications and external identity providers — including Okta itself - through identity brokering. -

- ), - text: - "Yes. Keycloak is built on these standards and excels at identity federation, interoperating with both modern applications and external identity providers — including Okta itself through identity brokering.", + a:

Yes. Keycloak is built on these standards and excels at identity federation, interoperating with both modern applications and external identity providers — including Okta itself through identity brokering.

, + text: "Yes. Keycloak is built on these standards and excels at identity federation, interoperating with both modern applications and external identity providers — including Okta itself through identity brokering.", }, { q: "Can Keycloak be self-hosted or run on-premise?", - a: ( -

- Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This - flexibility is a key advantage over Okta's cloud-only model, especially for data-residency, - sovereignty, and compliance requirements. -

- ), - text: - "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over Okta's cloud-only model, especially for data-residency, sovereignty, and compliance requirements.", + a:

Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over Okta's cloud-only model, especially for data-residency, sovereignty, and compliance requirements.

, + text: "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over Okta's cloud-only model, especially for data-residency, sovereignty, and compliance requirements.", }, ]; +const migration = { + heading: "Already using Okta?", + body: "Moving to Keycloak is more approachable than most teams expect. We import users, broker authentication during a phased cutover, and move you off Okta without disrupting access.", +}; + +const bigcta = { + heading: "See how much you'd save.", + body: "A 30-minute demo and a custom proposal — keyed to your current Okta contract — usually beats your renewal.", +}; + export default function KeycloakVsOkta() { return ( ); } diff --git a/src/pages/keycloak-alternatives/onelogin.jsx b/src/pages/keycloak-alternatives/onelogin.jsx index a5101f49..af31abd7 100644 --- a/src/pages/keycloak-alternatives/onelogin.jsx +++ b/src/pages/keycloak-alternatives/onelogin.jsx @@ -3,296 +3,202 @@ import React from "react"; import ComparisonLayout from "../../components/comparison/ComparisonLayout"; const meta = { - title: "Keycloak vs. OneLogin: The Open-Source Alternative", + title: "Keycloak vs. OneLogin — Phase Two", description: - "An in-depth comparison of Keycloak vs. OneLogin — cost, deployment, customization, scalability, and support — and why Keycloak is a strong open-source alternative to OneLogin.", + "A 2026 comparison of Keycloak vs. OneLogin — cost, deployment, maintenance, and features — and why managed Keycloak is a strong open-source alternative for workforce SSO and access management.", keywords: - "keycloak vs onelogin, onelogin alternative, open source onelogin alternative, onelogin pricing, managed keycloak, workforce sso", + "keycloak vs onelogin, onelogin alternative, open source onelogin alternative, onelogin pricing, workforce sso, managed keycloak", }; -const heroIntro = ( - <> - OneLogin (by One Identity) is a commercial workforce SSO and access management platform; - Keycloak is the open-source alternative that competes strongly on cost, control, and - customization. Here's how the two compare across cost, deployment, customization, - scalability, functionality, and support — and why pairing Keycloak with a managed host like - Phase Two often gives you the best of both. - -); +const hero = { + variant: "B", + headline: ( + <>Workforce SSO without per-module pricing. + ), + lede: ( + <> + OneLogin is a workforce SSO and access-management platform billed per user, with capabilities + split across add-on modules. Keycloak delivers the same workforce SSO, MFA, and directory + integration — without per-user, per-module pricing — backed by Phase Two hosting and support. + + ), + secondaryCta: { label: "See the comparison →", href: "#glance" }, + miniRows: [ + { feat: "Per-user, per-module pricing", vendor: "$$$", keycloak: "lim" }, + { feat: "Open-source core", vendor: "no", keycloak: "yes" }, + { feat: "Self-host / on-premise", vendor: "no", keycloak: "yes" }, + { feat: "SAML / OIDC / OAuth 2.0", vendor: "yes", keycloak: "yes" }, + { feat: "Vendor lock-in", vendor: { label: "High", red: true }, keycloak: "yes" }, + ], +}; const atAGlance = [ - { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, - { dim: "Pricing driver", vendor: "Per user per month + feature tiers", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, - { dim: "Cost predictability", vendor: "Scales with users and advanced features; opaque enterprise pricing", keycloak: "Predictable; decoupled from user growth" }, - { dim: "Deployment", vendor: "Primarily cloud SaaS, some on-premise options", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, - { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, - { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML", keycloak: "OAuth 2.0, OIDC, SAML" }, - { dim: "Extensibility", vendor: "Customizable interface, bounded options", keycloak: "Full source access + SPIs/extensions" }, - { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, + { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open-source (Apache 2.0), no license fee", check: true }, + { dim: "Pricing driver", vendor: "Per-user, per-module", keycloak: "Fixed infrastructure / hosting cost, not per-user", check: true }, + { dim: "Cost predictability", vendor: "Add-on modules stack up", keycloak: "Predictable, decoupled from user growth", check: true }, + { dim: "Deployment", vendor: "Cloud / SaaS only", keycloak: "Self-hosted, your cloud, on-premise, or managed", check: true }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location", check: true }, + { dim: "Standards", vendor: "SAML, OIDC, OAuth 2.0", keycloak: "SAML, OpenID Connect, OAuth 2.0" }, + { dim: "Extensibility", vendor: "App catalog + API, bounded", keycloak: "Full source access — SPI extensions, themes, custom code", check: true }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based", check: true }, ]; const sections = [ { - title: "Cost Structure", - body: ( - <> -

- As an open-source platform, Keycloak is free to use, making it a cost-effective option - for businesses of all sizes. There are no licensing fees; the trade-off is that you - manage your own hosting and infrastructure, which can incur costs depending on your - resource needs. -

-

- OneLogin operates on a subscription model, with per-user-per-month pricing for its basic - services. Advanced features such as multi-factor authentication (MFA) require higher-tier - licenses, which can drive up costs — particularly for large enterprises with many users - that need advanced security features. Pricing beyond the basic tiers is opaque and - generally requires engaging OneLogin sales. -

-

- Winner: Keycloak. It is more economically advantageous and transparent, - particularly for organizations equipped to manage their own hosting. You can leverage - Phase Two's hosting to test and integrate authentication and - authorization into your applications, and see a side-by-side{" "} - pricing estimate. -

- - ), - }, - { - title: "Deployment and Maintenance", - body: ( - <> -

- Keycloak supports on-premises and private cloud deployments. Organizations get full - control over configuration, but they also bear the responsibility for maintenance and - updates. -

-

- OneLogin is primarily a cloud-based solution, though it also provides on-premises options. - Because it is managed by the vendor, organizations benefit from automatic updates and less - internal maintenance. -

-

- Winner: OneLogin for self-hosted Keycloak — it simplifies deployment and reduces - maintenance for IT teams. That trade-off largely disappears with managed Keycloak: - Phase Two provides managed hosting and{" "} - zero-downtime upgrades, so you keep - Keycloak's control without the operational load — and you can still{" "} - self-host or use managed hosting as your - needs change. -

- - ), - }, - { - title: "Customization and Branding", + id: "cost", + kicker: "01 — TCO", + title: "Cost of Ownership", body: ( <> -

- Keycloak allows extensive customization, enabling organizations to tailor authentication - workflows and user interfaces to specific needs. When unifying login from multiple systems - into a single one, Keycloak can adapt and support those requirements as necessary. This - level of customization may, however, require more technical expertise. -

-

- OneLogin offers a customizable interface, but its options are more limited than Keycloak's. - It focuses on providing a unified experience without deep customization, and specific - business use-cases may not be supported. -

-

- Winner: Keycloak. It wins on customization and flexibility; OneLogin - provides simplicity, but without the same ability to adapt to specific needs. -

+

OneLogin (now part of One Identity) prices per user, per month, with the workforce-identity capabilities most organizations want spread across plan tiers and add-on modules. The base plan looks affordable; the number that matters is what it costs once you add the modules you actually need.

+

As of 2026, OneLogin's published workforce pricing scales roughly like this:

+ + + + + + + + +
PlanPrice (per user / mo)Highlights
Basic$3SSO, MFA, Desktop Basic, lifecycle mgmt (5 apps)
Essentials$6Unlimited lifecycle management, Advanced Directory
Business$10SmartFactor, Desktop MFA, HR directories, RADIUS, Smart Hooks
EnterpriseQuote onlyLDAP sync, delegated admin, multiple brands, API Access Management
+

Figures reflect OneLogin's published list pricing as of 2026 (onelogin.com/product/pricing); typically billed annually. Customer Identity (CIAM) plans and the Enterprise tier are quote-only, and OneLogin Workflows is a separate $2/user/month add-on.

+

The per-user, per-module structure is what drives the real cost. Each employee is a recurring charge, and the advanced capabilities — adaptive MFA, lifecycle automation, HR-driven provisioning — push you into higher plans or paid add-ons. As headcount and requirements grow, so does the bill, on two axes at once.

+

Worse, several of the capabilities larger organizations depend on — API Access Management, LDAP sync, delegated administration, and Customer Identity (CIAM) — sit in the quote-only Enterprise tier, so the headline per-user numbers rarely reflect what an enterprise rollout actually costs.

+

Keycloak provides workforce SSO, MFA, LDAP/Active Directory integration, and brokering with no per-user fee and no module gating — every capability is part of the same open-source platform. Cost is driven by the infrastructure it runs on, not your employee count.

+

Winner: Keycloak

+

Phase Two managed hosting keeps that spend fixed as your workforce grows. See a side-by-side pricing estimate vs. OneLogin.

), }, { - title: "Scalability and Performance", + id: "architecture", + kicker: "02 — Deployment", + title: "Architecture & Deployment", body: ( <> -

- Keycloak is designed to scale efficiently, accommodating large user bases through - horizontal scaling and clustered deployments, which makes it suitable for extensive - enterprise environments. -

-

- As a cloud solution, OneLogin is also scalable, but it is typically geared toward - medium-sized enterprises. It can handle multiple applications but may not perform optimally - under very high user loads. -

-

- Winner: Both can scale, but Keycloak is the better choice for large-scale - applications requiring high concurrency and many user sessions. -

+

OneLogin is a cloud-based service, so there is little infrastructure to set up. That enables quick deployment and removes much of the DevOps burden. The trade-off is that enterprises with strict regulatory or data-residency requirements often need on-premise options that a SaaS-only model can't fully provide.

+

Keycloak can be deployed on-premise, in your own cloud, or via a managed cloud service. Because you control the deployment environment, it conforms to compliance and data-sovereignty needs and gives you greater control over your security and compliance standards.

+

Winner: Depends

+

If you need on-premise or strict data control, Keycloak wins clearly — and it still gives you the flexibility to self-host or use managed hosting.

), }, { - title: "Functionality and Flexibility", + id: "maintenance", + kicker: "03 — Operations", + title: "Maintenance", body: ( <> -

- Keycloak provides a comprehensive suite of features, including diverse authentication - methods, fine-grained access control, and strong identity federation capabilities - (OpenID Connect, OAuth 2.0, SAML 2.0). It allows for deeper integration with existing - systems. -

-

- OneLogin is built on Ruby on Rails and includes essential features such as SSO and MFA, - using machine learning to assess user risk scores and enhance security. However, it may - not match Keycloak in offering a wide array of advanced features for complex IAM scenarios. -

-

- Winner: Keycloak. It holds an advantage with its broader range of - functionality and its flexibility of integration. -

+

A strong advantage of OneLogin is that it's a managed service. From a DevOps perspective, it requires minimal maintenance — the OneLogin team handles updates, security patches, and infrastructure, keeping the system up to date. This comes at a cost, though, since customization is comparatively limited.

+

Self-hosted Keycloak requires more attention: organizations must allocate resources for installing, configuring, and updating the software, as well as managing the underlying infrastructure. This can be a drawback for teams without the necessary expertise. Phase Two removes this trade-off entirely: with managed hosting and zero-downtime upgrades, you get Keycloak's control without the operational load.

+

Winner: OneLogin for self-hosted Keycloak — a tie when Keycloak is managed by Phase Two

), }, { - title: "Integration Capabilities", + id: "functionality", + kicker: "04 — Capability", + title: "Functionality & Flexibility", body: ( <> -

- Keycloak supports integration with various identity providers and protocols, enabling - flexible authentication across systems. It also has built-in support for many social - identity providers — such as Google, Twitter, Facebook, and Stack Overflow — which can be - configured in an advanced manner. -

-

- OneLogin features a well-developed library of pre-built integrations for third-party - applications, providing a straightforward way to manage user access across systems. It also - integrates with HR systems and supports directory integrations, which can be particularly - useful for organizations relying on a variety of SaaS applications. -

-

- Winner: It depends on your needs. OneLogin is easier for basic - integrations, while Keycloak offers greater versatility for complex requirements. -

+

OneLogin covers the workforce-identity essentials: SSO with a large app catalog, MFA (including its SmartFactor adaptive auth), a cloud directory, and lifecycle/provisioning — with deeper capabilities available as add-on modules. It's a capable, established access-management product.

+

Keycloak matches the core — SSO, MFA, directory federation via LDAP and Active Directory, and brokering — and adds fine-grained authorization (RBAC/ABAC) and fully themeable login. Being open source, every capability is included and extensible rather than gated behind modules.

+

Winner: Keycloak

+

The two are comparable on workforce SSO; Keycloak delivers it without per-module pricing and with a far higher customization ceiling.

), }, { - title: "Community and Support", + id: "integrating", + kicker: "05 — Interop", + title: "Integrating Keycloak with external systems like OneLogin", body: ( <> -

- Keycloak has a supportive open-source community, with extensive documentation and user - forums for troubleshooting and guidance. Phase Two offers{" "} - enterprise support for hosted and on-prem customers, as well as - for those running their own Keycloak deployment. -

-

- OneLogin provides dedicated customer support, along with comprehensive documentation and - professional services for additional assistance. -

-

- Winner: It depends. Keycloak's community offers robust support for users, - while OneLogin provides more direct, vendor-driven help. -

+

For organizations looking to transition from OneLogin to Keycloak — or to integrate Keycloak with systems already using OneLogin — Keycloak's flexibility offers a significant advantage. Keycloak can act as a broker that sits between OneLogin and your applications, letting you leverage the strengths of both platforms during a transition.

+

Keycloak's identity-brokering capability lets it delegate authentication to external identity providers (IdPs) such as OneLogin. Keycloak can manage internal permissions and roles, provide additional security checks, and maintain a consistent, user-friendly login experience across systems. This makes migrating off OneLogin a low-risk, phased process — you can move one piece at a time without disrupting user access or security.

), }, { - title: "Which one is best for me?", + id: "best", + kicker: "06 — Verdict", + title: "Which IAM solution is best for me?", body: ( <> -

- When selecting an IAM solution, it's essential to evaluate your organization's specific - needs. Keycloak is ideal for those seeking an open-source, highly customizable platform - that can scale to meet complex requirements. OneLogin, by contrast, is well-suited for - enterprises looking for an easy-to-use, managed service with a focus on integrations. As an - implementation grows in size, however, the cost can become too high to entertain. -

-

- Working with Phase Two provides some of the best of both worlds: easy integration with the - ability to scale without incurring additional per-user costs. If you're looking to{" "} - migrate to Keycloak, or have questions - about Phase Two's enterprise support, you can also explore{" "} - on-premise deployment options. -

+

OneLogin is a reasonable fit for organizations that want a turnkey workforce SSO product and accept per-user, per-module pricing. For teams that want to avoid module gating, need on-premise or data-residency control, or want predictable cost as headcount grows, Keycloak is the more flexible and economical choice.

+

Phase Two runs Keycloak with enterprise hosting and 24/7 support, giving you workforce identity on open standards — without per-user licensing or vendor lock-in.

), }, ]; +const matrix = { + savings: "~80%", + rows: [ + { feat: "Per-user / per-module pricing penalty", vendor: "$$$", keycloak: "lim" }, + { feat: "Open-source core", vendor: "no", keycloak: "yes" }, + { feat: "Self-hostable (no lock-in)", vendor: "no", keycloak: "yes" }, + { feat: "On-premise / data residency", vendor: "no", keycloak: "yes" }, + { feat: "All capabilities without add-on modules", vendor: "$$$", keycloak: "yes" }, + { feat: "Custom SAML / OIDC IdPs", vendor: "yes", keycloak: "yes" }, + { feat: "Full source access & SPI extensions", vendor: "lim", keycloak: "yes" }, + { feat: "Federate / broker existing IdP (LDAP/AD)", vendor: "lim", keycloak: "yes" }, + { feat: "24/7 escalation with Keycloak experts", vendor: "lim", keycloak: "yes" }, + ], +}; + const faqs = [ { q: "Is Keycloak a good alternative to OneLogin?", - a: ( -

- Yes. Keycloak supports the same core standards as OneLogin (OAuth 2.0, OpenID Connect, SAML) - and offers a comprehensive set of authentication and authorization features, while being open - source and free of per-user licensing. The main trade-off is operational overhead, which a - managed host like Phase Two removes. -

- ), - text: - "Yes. Keycloak supports the same core standards as OneLogin (OAuth 2.0, OpenID Connect, SAML) and offers a comprehensive set of features, while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + a:

Yes. Keycloak supports the same standards as OneLogin (SAML, OIDC, OAuth 2.0) and covers workforce SSO, MFA, and LDAP/Active Directory integration, while being open source and free of per-user, per-module licensing.

, + text: "Yes. Keycloak supports the same standards as OneLogin (SAML, OIDC, OAuth 2.0) and covers workforce SSO, MFA, and LDAP/Active Directory integration, while being open source and free of per-user, per-module licensing.", }, { q: "Is Keycloak cheaper than OneLogin?", - a: ( -

- For most growing organizations, yes. OneLogin pricing is per user per month and climbs with - advanced features such as MFA, while Keycloak's cost is driven by hosting infrastructure and - stays largely fixed as your user base grows. As implementations scale, OneLogin's per-user - model can become significantly more expensive than running Keycloak. -

- ), - text: - "For most growing organizations, yes. OneLogin pricing is per user per month and climbs with advanced features such as MFA, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows.", + a:

For most organizations, yes. OneLogin bills per user with advanced capabilities in higher plans or paid modules. Keycloak is priced on infrastructure and stays largely fixed as headcount grows, so teams frequently see substantial savings.

, + text: "For most organizations, yes. OneLogin bills per user with advanced capabilities in higher plans or paid modules. Keycloak is priced on infrastructure and stays largely fixed as headcount grows, so teams frequently see substantial savings.", }, { q: "Can I migrate from OneLogin to Keycloak?", - a: ( -

- Yes. Keycloak can import your users and broker authentication during a phased cutover, so you - can migrate incrementally without disrupting access. See{" "} - Migrate to Keycloak. -

- ), - text: - "Yes. Keycloak can import your users and broker authentication during a phased cutover, so you can migrate incrementally without disrupting access.", + a:

Yes. Keycloak can broker authentication to OneLogin and import users during a phased cutover, so you can migrate incrementally without disrupting employee access. See Migrate to Keycloak.

, + text: "Yes. Keycloak can broker authentication to OneLogin and import users during a phased cutover, so you can migrate incrementally without disrupting employee access.", }, { - q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", - a: ( -

- Yes. Keycloak is built on these standards and provides strong identity federation, with - built-in support for many social identity providers and integration with existing systems - such as LDAP and Active Directory. -

- ), - text: - "Yes. Keycloak is built on these standards and provides strong identity federation, with built-in support for many social identity providers and integration with existing systems such as LDAP and Active Directory.", + q: "Does Keycloak integrate with LDAP and Active Directory?", + a:

Yes. Keycloak federates LDAP and Active Directory natively and can broker other identity providers, making it well suited to workforce identity scenarios.

, + text: "Yes. Keycloak federates LDAP and Active Directory natively and can broker other identity providers, making it well suited to workforce identity scenarios.", }, { q: "Can Keycloak be self-hosted or run on-premise?", - a: ( -

- Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This - flexibility gives you full control over configuration, data residency, and compliance — an - advantage over a primarily cloud-based model. See{" "} - on-premise deployment. -

- ), - text: - "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility gives you full control over configuration, data residency, and compliance.", + a:

Yes. Keycloak runs on-premise, in your own cloud, or as a managed service — a key advantage over OneLogin's cloud-only model for data-residency and compliance.

, + text: "Yes. Keycloak runs on-premise, in your own cloud, or as a managed service — a key advantage over OneLogin's cloud-only model for data-residency and compliance.", }, ]; +const migration = { + heading: "Already using OneLogin?", + body: "Moving to Keycloak is more approachable than most teams expect. We import users, broker authentication during a phased cutover, and move you off OneLogin without disrupting access.", +}; + +const bigcta = { + heading: "See how much you'd save.", + body: "A 30-minute demo and a custom proposal — keyed to your current OneLogin contract — usually beats your renewal.", +}; + export default function KeycloakVsOneLogin() { return ( ); } diff --git a/src/pages/keycloak-alternatives/ping-identity.jsx b/src/pages/keycloak-alternatives/ping-identity.jsx index 64a88c59..cad7e40c 100644 --- a/src/pages/keycloak-alternatives/ping-identity.jsx +++ b/src/pages/keycloak-alternatives/ping-identity.jsx @@ -3,336 +3,198 @@ import React from "react"; import ComparisonLayout from "../../components/comparison/ComparisonLayout"; const meta = { - title: "Keycloak vs. Ping Identity: The Open-Source Alternative", + title: "Keycloak vs. Ping Identity — Phase Two", description: - "An in-depth comparison of Keycloak vs. Ping Identity — deployment, customization, pricing, scalability, and features — and why Keycloak is a strong open-source alternative to Ping Identity.", + "A 2026 comparison of Keycloak vs. Ping Identity — cost, deployment, maintenance, and features — and why managed Keycloak is a strong open-source alternative to Ping's quote-based enterprise suite.", keywords: - "keycloak vs ping identity, ping identity alternative, open source ping identity alternative, ping identity pricing, managed keycloak", + "keycloak vs ping identity, ping identity alternative, open source ping alternative, pingone pricing, managed keycloak", }; -const heroIntro = ( - <> - Ping Identity is an established commercial IAM platform built for large - enterprises; Keycloak is the open-source alternative that competes strongly - on customization, cost, and flexibility. Here's how the two compare across - deployment, pricing, scalability, and features — and why pairing Keycloak - with a managed host like Phase Two often gives you enterprise capability - without the enterprise license. - -); +const hero = { + variant: "A", + headline: ( + <> + You don't need a Ping contract.
You need managed Keycloak. + + ), + lede: ( + <> + Ping Identity is a large-enterprise IAM suite sold through quote-based annual contracts. Keycloak delivers the same enterprise standards and federation depth — without the suite lock-in or the opaque pricing — and Phase Two backs it with enterprise-grade hosting and support. + + ), + secondaryCta: { label: "See the comparison →", href: "#glance" }, + savingsPill: ( + <>Teams leaving quote-based enterprise contracts recover up to ~80% of identity spend + ), +}; const atAGlance = [ - { dim: "Licensing model", vendor: "Proprietary, commercial license", keycloak: "Open source (Apache 2.0), no license fee" }, - { dim: "Pricing driver", vendor: "User count + features", keycloak: "Fixed infrastructure / hosting cost, not per-user" }, - { dim: "Cost predictability", vendor: "Scales with users and features; can climb steeply at large deployments", keycloak: "Predictable; decoupled from user growth" }, - { dim: "Deployment", vendor: "Hybrid — cloud-based and on-premises", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, - { dim: "Data residency / sovereignty", vendor: "Strong control via hybrid/on-prem options", keycloak: "Full control over environment and data location" }, - { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML", keycloak: "OAuth 2.0, OIDC, SAML" }, - { dim: "Extensibility", vendor: "Configurable, but customization takes more effort", keycloak: "Full source access + SPIs/extensions" }, - { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, + { dim: "Licensing model", vendor: "Proprietary, enterprise contract", keycloak: "Open-source (Apache 2.0), no license fee", check: true }, + { dim: "Pricing driver", vendor: "Quote-based; negotiated annually", keycloak: "Fixed infrastructure / hosting cost", check: true }, + { dim: "Cost predictability", vendor: "Opaque; renegotiated each renewal", keycloak: "Predictable, decoupled from user growth", check: true }, + { dim: "Deployment", vendor: "Cloud + self-managed options", keycloak: "Self-hosted, your cloud, on-premise, or managed", check: true }, + { dim: "Data residency / sovereignty", vendor: "Good (self-managed available)", keycloak: "Full control over environment and data location", check: true }, + { dim: "Standards", vendor: "SAML, OIDC, OAuth 2.0, FIDO2", keycloak: "SAML, OpenID Connect, OAuth 2.0, FIDO2", check: true }, + { dim: "Extensibility", vendor: "Configurable, suite-bound", keycloak: "Full source access — SPI extensions, themes, custom code", check: true }, + { dim: "Vendor lock-in", vendor: "High (suite lock-in)", keycloak: "Low — portable, standards-based", check: true }, ]; const sections = [ { - title: "Deployment Model", - body: ( - <> -

- Keycloak is an open-source IAM solution that can be deployed both{" "} - on-premise and in cloud - environments. This flexibility lets organizations choose their - preferred hosting option while maintaining control over their identity - management infrastructure. Its ability to adapt quickly to new - standards makes it particularly suitable for agile development - environments. -

-

- Ping Identity offers a hybrid deployment model that combines both - cloud-based and on-premises options. This versatility is particularly - beneficial for large enterprises where regulatory compliance dictates - specific control over identity services. -

-

- - Winner: Tie. - {" "} - Both solutions offer strong options for those who need to deploy the - way they want to. Both provide enterprise-centric hybrid options that - accommodate complex infrastructure needs — and with Keycloak you can{" "} - - self-host or use managed hosting - {" "} - without changing platforms. -

- - ), - }, - { - title: "Customization and Flexibility", - body: ( - <> -

- Keycloak shines with its extensive customization features, allowing - developers to modify everything from login pages to role-based access - controls. Being open-source software, organizations have the freedom - to make adjustments at any time without vendor lock-in, making it a - powerful and cost-effective solution. It can be used as a standalone - solution or integrated as an element of a broader IT infrastructure. -

-

- Ping Identity also offers customization capabilities, but often - demands more technical effort to implement tailored solutions. While - it is configurable, achieving significant customizations may be more - challenging compared to Keycloak. -

-

- Winner: Keycloak for its superior flexibility and - ease of customization, particularly appealing to developers. -

- - ), - }, - { - title: "User Experience and Ease of Use", + id: "cost", + kicker: "01 — TCO", + title: "Cost of Ownership", body: ( <> -

- Keycloak is designed with usability in mind, featuring an intuitive - interface and a straightforward setup process. Its fast, agile nature - allows it to adapt quickly to changing application landscapes, - ensuring accessibility for users. It supports Single Sign-On (SSO), - identity brokering, and various protocols (OAuth 2.0, OpenID Connect, - SAML), streamlining the user experience. -

-

- Ping Identity prioritizes a comprehensive user experience targeting - both technical and non-technical users. Although it features a polished - interface, the initial setup can be complex, resulting in a steeper - learning curve for administrators. -

-

- Winner: Keycloak edges out in user-friendliness - during initial setup and usability. -

+

Ping Identity sells to large enterprises, and its pricing reflects that. Deals are assembled from a suite of products — PingOne for SSO and MFA, PingFederate, PingAccess, PingDirectory, PingOne for identity verification and risk — and negotiated as an annual contract.

+

Ping publishes some entry pricing for its PingOne cloud products, but most engagements are quote-based. As of 2026, published figures look like this:

+ + + + + + + + + +
ProductPlanPrice
PingOne for WorkforceEssential$3 per user/mo*
PingOne for WorkforcePlus$6 per user/mo*
PingOne for CustomersEssentialStarting at $35k/year
PingOne for CustomersPlusStarting at $50k/year
PingOne for CustomersPasswordlessQuote only
+

Figures reflect Ping Identity's published pricing as of 2026 (pingidentity.com/platform/pricing). *Workforce pricing is based on an annual contract with a 5,000-user minimum — so the practical floor is roughly $180k/year (Essential) to $360k/year (Plus) before add-ons.

+

The practical issue with Ping isn't a single high number — it's the floor and the predictability. Even the entry Workforce tier assumes a 5,000-seat annual commitment, and CIAM (PingOne for Customers) starts in the tens of thousands of dollars per year — large-enterprise budget territory before you add a single module. Because everything is quote-based and bundled, costs are hard to forecast, hard to compare, and tend to climb at each renewal as modules and user counts grow.

+

Keycloak covers the standards and federation depth Ping is known for — SAML, OIDC, OAuth 2.0, FIDO2/WebAuthn, brokering, and fine-grained authorization — with no license fee. Your cost is the infrastructure it runs on, which makes spend transparent and stable.

+

Winner: Keycloak

+

Phase Two delivers Keycloak with the enterprise hosting and support large organizations expect — without the contract lock-in. See a side-by-side pricing estimate vs. Ping.

), }, { - title: "Scalability and Performance", + id: "architecture", + kicker: "02 — Deployment", + title: "Architecture & Deployment", body: ( <> -

- With its cloud-native adaptation and support for high-volume user - bases, Keycloak scales effectively to meet organizational needs. - However, managing a scaled Keycloak system can require significant - time and resources without{" "} - proper enterprise support. -

-

- Ping Identity is designed for large-scale environments with robust - scalability features, ensuring seamless performance under heavy loads, - making it particularly suited for large organizations. -

-

- Winner: Ping Identity excels in scalability and - performance, proving its capability to manage large-scale - authentication requests. However, this comes at a larger cost, which - could be offset by taking on the management of Keycloak. -

+

Ping is unusual among commercial vendors in offering both cloud (PingOne) and self-managed/on-premise deployment of its server products. That flexibility is genuine — and a reason large, regulated enterprises choose it — but it comes bundled with suite licensing and the operational weight of running Ping's stack.

+

Keycloak offers the same deployment freedom — on-premise, your own cloud, or a managed cloud service — on an open-source base, so you control the environment without per-product licensing.

+

Winner: Tie

+

Both can run self-managed; Keycloak does it without contract lock-in, and Phase Two can manage it for you.

), }, { - title: "Pricing Model", + id: "maintenance", + kicker: "03 — Operations", + title: "Maintenance", body: ( <> -

- Being open-source software, Keycloak has no licensing fees, making it - highly cost-effective. Organizations should, however, consider - potential indirect costs related to deployment and system management. -

-

- Ping Identity operates on a traditional licensing model based on user - count and features, which can lead to higher costs, particularly for - larger deployments. -

-

- Winner: Keycloak is the clear winner for pricing, - offering a more budget-friendly option. Coupled with a cost-conscious - hosting provider, this can save an organization substantially over the - course of an implementation. See a side-by-side{" "} - hosting pricing estimate. -

+

Ping's managed PingOne services reduce operational burden, while its self-managed products (PingFederate, PingDirectory, PingAccess) require dedicated expertise to run and upgrade — often a specialized team.

+

Self-hosted Keycloak likewise needs attention for installation, configuration, and upgrades. Phase Two removes that trade-off: with managed hosting and zero-downtime upgrades, you get the control of self-managed identity without the operational load — and at a fraction of an enterprise suite's run cost.

+

Winner: a tie when Keycloak is managed by Phase Two

), }, { - title: "Integration Ecosystem", + id: "functionality", + kicker: "04 — Capability", + title: "Functionality & Flexibility", body: ( <> -

- Keycloak provides a strong API and a powerful admin portal, making it - compatible with a wide range of frameworks like Spring Boot, Django, - React, and more. Its supportive community contributes extensions and - integrations alongside continuous improvements, enhancing its - adaptability. -

-

- Ping Identity features a curated integration ecosystem focused on - enterprise-level applications, providing documentation and support for - integrations, but it may lack the range of community-driven options - available with Keycloak. -

-

- Winner: Keycloak takes the lead for its extensive - integration options and supportive community. Leverage Phase Two's{" "} - hosting to test and integrate - authentication and authorization into your applications. -

+

Ping is a deep, mature identity suite: strong federation (PingFederate), directory (PingDirectory), access management (PingAccess), adaptive MFA, risk, and identity verification. For the largest, most complex enterprises, that breadth is real — and Ping has decades of hardening behind it.

+

Keycloak matches Ping on the core standards and federation patterns most organizations need, with brokering, fine-grained authorization, MFA, and WebAuthn/FIDO2. Where Ping extends through a licensed suite, Keycloak extends through open source — themes, SPIs, and the full codebase — backed by a large community and Phase Two's contributed extensions.

+

Winner: Keycloak (for most)

+

The very largest identity programs may still value Ping's specialized modules; most teams get what they need from Keycloak with far more flexibility and lower cost.

), }, { - title: "Advanced Features", + id: "integrating", + kicker: "05 — Interop", + title: "Integrating Keycloak with external systems like Ping", body: ( <> -

- Keycloak supports fine-grained authorization and customizable themes, - making it a flexible and cost-effective solution for diverse security - needs. Its rapid adaptability to new technologies helps organizations - stay relevant in a changing landscape. -

-

- Ping Identity excels with advanced features such as fraud detection, - identity verification, and robust orchestration capabilities, - positioning it as a strong choice for larger enterprises requiring - comprehensive security and compliance. -

-

- Winner: Tie. Both Keycloak and Ping Identity offer - valuable advanced features — Keycloak provides flexibility for diverse - environments, while Ping Identity delivers robust security measures - suited to complex enterprise needs. -

+

For organizations looking to transition from Ping to Keycloak — or to integrate Keycloak with systems already using Ping — Keycloak's flexibility offers a significant advantage. Keycloak can act as a broker that sits between Ping and your applications, letting you leverage the strengths of both platforms during a transition.

+

Keycloak's identity-brokering capability lets it delegate authentication to external identity providers (IdPs) such as Ping. Keycloak can manage internal permissions and roles, provide additional security checks, and maintain a consistent, user-friendly login experience across systems. This makes migrating off Ping a low-risk, phased process — you can move one piece at a time without disrupting user access or security.

), }, { - title: "Which one is best for me?", + id: "best", + kicker: "06 — Verdict", + title: "Which IAM solution is best for me?", body: ( <> -

- Both Keycloak and Ping Identity provide essential IAM capabilities, - but their strengths cater to different organizational needs. Keycloak - excels in customization, user experience, cost-effectiveness, and - flexibility, making it ideal for organizations prioritizing quick - adaptation and flexibility. In contrast, Ping Identity stands out with - its hybrid deployment capabilities, scalability, and advanced security - functionality, positioning it as a strong choice for larger - enterprises. Ultimately, the decision should align with the specific - requirements, resources, and strategic goals of your organization. -

-

- If you're looking to{" "} - migrate to Keycloak, or - have questions about Phase Two's{" "} - enterprise support, please{" "} - - contact us - - . -

+

Ping Identity makes sense for very large enterprises with complex, governance-heavy identity programs and the budget for a negotiated suite. For organizations that want the same standards and self-managed deployment without opaque, escalating contracts — or that simply want predictable cost — Keycloak is the stronger, more flexible foundation.

+

Phase Two pairs Keycloak with enterprise hosting, migration, and 24/7 support, giving large organizations the assurance of a vendor relationship without the lock-in of a proprietary suite.

), }, ]; +const matrix = { + savings: "~80%", + rows: [ + { feat: "Quote-based / opaque pricing", vendor: "$$$", keycloak: "lim" }, + { feat: "Open-source core", vendor: "no", keycloak: "yes" }, + { feat: "Self-hostable (no lock-in)", vendor: "lim", keycloak: "yes" }, + { feat: "On-premise / data residency", vendor: "yes", keycloak: "yes" }, + { feat: "No suite license lock-in", vendor: "no", keycloak: "yes" }, + { feat: "Custom SAML / OIDC / FIDO2", vendor: "yes", keycloak: "yes" }, + { feat: "Full source access & SPI extensions", vendor: "lim", keycloak: "yes" }, + { feat: "Federate / broker existing IdP", vendor: "yes", keycloak: "yes" }, + { feat: "24/7 escalation with Keycloak experts", vendor: "lim", keycloak: "yes" }, + ], +}; + const faqs = [ { q: "Is Keycloak a good alternative to Ping Identity?", - a: ( -

- Yes. Keycloak supports the same core standards as Ping Identity (OAuth - 2.0, OpenID Connect, SAML) and matches it on most authentication and - authorization features, while being open source and free of per-user - licensing. It is especially compelling for teams that value - customization and flexibility. The main trade-off is operational - overhead, which a managed host like Phase Two removes. -

- ), - text: - "Yes. Keycloak supports the same core standards as Ping Identity (OAuth 2.0, OpenID Connect, SAML) and matches it on most features, while being open source and free of per-user licensing. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + a:

Yes. Keycloak supports the same core standards as Ping (SAML, OIDC, OAuth 2.0, FIDO2/WebAuthn) and covers federation, brokering, and fine-grained authorization, while being open source and free of suite licensing. The trade-off is operational overhead, which Phase Two removes.

, + text: "Yes. Keycloak supports the same core standards as Ping (SAML, OIDC, OAuth 2.0, FIDO2/WebAuthn) and covers federation, brokering, and fine-grained authorization, while being open source and free of suite licensing. The trade-off is operational overhead, which Phase Two removes.", }, { - q: "Is Keycloak cheaper than Ping Identity?", - a: ( -

- For most deployments, yes. Ping Identity is licensed based on user count - and features, which can climb steeply for larger deployments, while - Keycloak has no license fee and its cost is driven primarily by hosting - infrastructure, staying largely fixed as your user base grows. Paired - with a cost-conscious host, this can save an organization substantially - over the course of an implementation. -

- ), - text: - "For most deployments, yes. Ping Identity is licensed based on user count and features, while Keycloak has no license fee and its cost is driven primarily by hosting infrastructure, staying largely fixed as your user base grows.", + q: "Is Keycloak cheaper than Ping?", + a:

Almost always. Ping is sold via quote-based enterprise contracts that bundle multiple products and renegotiate at renewal. Keycloak has no license fee and is priced on infrastructure, making spend transparent and stable.

, + text: "Almost always. Ping is sold via quote-based enterprise contracts that bundle multiple products and renegotiate at renewal. Keycloak has no license fee and is priced on infrastructure, making spend transparent and stable.", }, { - q: "Can Keycloak and Ping Identity both be deployed on-premise?", - a: ( -

- Yes. Ping Identity offers a hybrid model combining cloud-based and - on-premises options, and Keycloak can run{" "} - on-premise, in your own cloud, or as a - managed service. Both are strong choices when regulatory compliance and - data sovereignty require control over where identity services run. -

- ), - text: - "Yes. Ping Identity offers a hybrid model combining cloud-based and on-premises options, and Keycloak can run on-premise, in your own cloud, or as a managed service. Both are strong choices when compliance requires control over where identity services run.", + q: "Can I migrate from Ping to Keycloak?", + a:

Yes. Keycloak can broker authentication to Ping during a phased cutover and import users and configuration incrementally, so you can retire Ping components one at a time. See Migrate to Keycloak.

, + text: "Yes. Keycloak can broker authentication to Ping during a phased cutover and import users and configuration incrementally, so you can retire Ping components one at a time.", }, { - q: "Does Keycloak support SAML, OIDC, and OAuth 2.0?", - a: ( -

- Yes. Keycloak is built on these standards and supports Single Sign-On - (SSO) and identity brokering, interoperating with both modern - applications and frameworks like Spring Boot, Django, and React. -

- ), - text: - "Yes. Keycloak is built on these standards and supports Single Sign-On (SSO) and identity brokering, interoperating with modern applications and frameworks like Spring Boot, Django, and React.", + q: "Does Keycloak support on-premise like Ping?", + a:

Yes. Keycloak runs on-premise, in your own cloud, or as a managed service — the same deployment freedom Ping offers, without the suite licensing.

, + text: "Yes. Keycloak runs on-premise, in your own cloud, or as a managed service — the same deployment freedom Ping offers, without the suite licensing.", }, { - q: "Can I migrate from Ping Identity to Keycloak?", - a: ( -

- Yes. Keycloak can import users and broker authentication during a phased - cutover, so you can migrate incrementally without disrupting access. See{" "} - Migrate to Keycloak, or - ask about Phase Two's enterprise support. -

- ), - text: - "Yes. Keycloak can import users and broker authentication during a phased cutover, so you can migrate incrementally without disrupting access.", + q: "Can Phase Two support Keycloak at enterprise scale?", + a:

Yes. Phase Two provides multi-region high-availability hosting, 24/7 escalation with named engineers, security backports, and architecture reviews — built for enterprise requirements.

, + text: "Yes. Phase Two provides multi-region high-availability hosting, 24/7 escalation with named engineers, security backports, and architecture reviews — built for enterprise requirements.", }, ]; +const migration = { + heading: "Already using Ping Identity?", + body: "Moving to Keycloak is more approachable than most teams expect. We import users, broker authentication during a phased cutover, and move you off Ping Identity without disrupting access.", +}; + +const bigcta = { + heading: "See how much you'd save.", + body: "A 30-minute demo and a custom proposal — keyed to your current Ping Identity contract — usually beats your renewal.", +}; + export default function KeycloakVsPingIdentity() { return ( ); } diff --git a/src/pages/keycloak-alternatives/workos.jsx b/src/pages/keycloak-alternatives/workos.jsx index 657b3864..663d9030 100644 --- a/src/pages/keycloak-alternatives/workos.jsx +++ b/src/pages/keycloak-alternatives/workos.jsx @@ -3,329 +3,201 @@ import React from "react"; import ComparisonLayout from "../../components/comparison/ComparisonLayout"; const meta = { - title: "Keycloak vs. WorkOS: The Open-Source Alternative", + title: "Keycloak vs. WorkOS — Phase Two", description: - "An in-depth comparison of Keycloak vs. WorkOS — cost of ownership, deployment, customization, scalability, and features — and why managed Keycloak is a strong open-source alternative to WorkOS.", + "A 2026 comparison of Keycloak vs. WorkOS — cost, deployment, maintenance, and features — and why managed Keycloak is a strong open-source alternative to WorkOS for enterprise SSO and SCIM.", keywords: - "keycloak vs workos, workos alternative, open source workos alternative, workos pricing, managed keycloak, workos sso", + "keycloak vs workos, workos alternative, open source workos alternative, workos pricing, enterprise sso, scim, managed keycloak", }; -const heroIntro = ( - <> - WorkOS is a closed-source, fully managed platform built to add SSO to an application quickly; - Keycloak is the open-source alternative that competes strongly on cost, control, and - extensibility. Here's how the two compare across cost of ownership, deployment, customization, - scalability, and features — and why pairing Keycloak with a managed host like Phase Two often - gives you the best of both. - -); +const hero = { + variant: "B", + headline: <>Enterprise SSO without the per-connection toll., + lede: ( + <> + WorkOS is a developer-focused platform for enterprise SSO, SCIM, and directory sync, billed per + connection. Keycloak is the open-source alternative that delivers the same enterprise standards — + priced on infrastructure, not per connection — with the option of managed hosting from + Phase Two. + + ), + secondaryCta: { label: "See the comparison →", href: "#glance" }, + miniRows: [ + { feat: "Per-connection pricing", vendor: "$$$", keycloak: "lim" }, + { feat: "Open-source core", vendor: "no", keycloak: "yes" }, + { feat: "Self-host / on-premise", vendor: "no", keycloak: "yes" }, + { feat: "SAML / OIDC / SCIM", vendor: "yes", keycloak: "yes" }, + { feat: "Vendor lock-in", vendor: { label: "High", red: true }, keycloak: "yes" }, + ], +}; const atAGlance = [ - { dim: "Licensing model", vendor: "Proprietary, subscription", keycloak: "Open source (Apache 2.0), no license fee" }, - { dim: "Pricing driver", vendor: "Per monthly active user + per-feature (SSO, SCIM, audit logs, custom domains)", keycloak: "Fixed infrastructure / hosting cost, not per-user or per-feature" }, - { dim: "Cost predictability", vendor: "Scales with users, connections, and features", keycloak: "Predictable; decoupled from user growth and feature gates" }, - { dim: "Deployment", vendor: "Cloud SaaS only, hosted by WorkOS", keycloak: "Self-hosted, your cloud, on-premise, or managed" }, - { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location" }, - { dim: "Standards", vendor: "OAuth 2.0, OIDC, SAML, SCIM", keycloak: "OAuth 2.0, OIDC, SAML, SCIM, LDAP" }, - { dim: "Extensibility", vendor: "Unified API, bounded customization", keycloak: "Full source access + SPIs/extensions" }, - { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based" }, + { dim: "Licensing model", vendor: "Proprietary, usage-based", keycloak: "Open-source (Apache 2.0), no license fee", check: true }, + { dim: "Pricing driver", vendor: "Per-connection / per-organization SSO", keycloak: "Fixed infrastructure / hosting cost, not per-connection", check: true }, + { dim: "Cost predictability", vendor: "Scales with SSO connections & orgs", keycloak: "Predictable, decoupled from connection count", check: true }, + { dim: "Deployment", vendor: "Cloud / SaaS only", keycloak: "Self-hosted, your cloud, on-premise, or managed", check: true }, + { dim: "Data residency / sovereignty", vendor: "Limited control", keycloak: "Full control over environment and data location", check: true }, + { dim: "Standards", vendor: "SAML, OIDC, SCIM", keycloak: "SAML, OpenID Connect, OAuth 2.0, SCIM", check: true }, + { dim: "Extensibility", vendor: "API-first, bounded", keycloak: "Full source access — SPI extensions, themes, custom code", check: true }, + { dim: "Vendor lock-in", vendor: "High", keycloak: "Low — portable, standards-based", check: true }, ]; const sections = [ { + id: "cost", + kicker: "01 — TCO", title: "Cost of Ownership", body: ( <> -

- WorkOS operates on a subscription-based model, where pricing is tied to the number of - monthly active users. While a large block of users is included at the base tier, WorkOS - charges separately for capabilities like custom domains, SSO connections, SCIM - provisioning, and audit logs. The more enterprise customers you onboard, the more your - costs grow — and with every feature enabled, the per-user cost climbs, so bills can rise - quickly and become a significant piece of overall IT spend. -

-

- Keycloak, by contrast, is open source and free to use regardless of users or scale. The - primary cost is the infrastructure to host and operate the software. Because cost isn't - driven by features, connections, or user counts, your spend tends to be{" "} - fixed — a far more predictable model when you're bringing multiple - applications together, since adding connections doesn't increase your bill. The biggest - cost factor becomes the scale of the infrastructure you need. -

-

- Winner: Keycloak. With the right hosting solution, Keycloak is a far - more cost-effective choice, freeing organizations to allocate funds elsewhere. Compare a{" "} - side-by-side pricing estimate, or start on{" "} - Phase Two's hosting to test and integrate authentication and - authorization into your applications. -

- - ), - }, - { - title: "Deployment and Maintenance", - body: ( - <> -

- WorkOS is a cloud-based identity platform that is hosted and managed by WorkOS. It offers - a simpler deployment process because there's no infrastructure to set up or maintain, and - organizations benefit from reduced internal IT burden since WorkOS handles updates, - security patches, and system maintenance. -

-

- Keycloak can be deployed on-premise or in a private cloud, giving you complete control - over the infrastructure and the ability to customize and integrate with existing systems. - With support for Docker, Kubernetes, and other containerization technologies, it slots - into existing environments and workflows. The trade-off with self-hosting is that - organizations must allocate resources to install, configure, update, and operate the - underlying infrastructure. Phase Two removes that trade-off with{" "} - managed hosting and{" "} - zero-downtime upgrades, so you keep - Keycloak's control without the operational load. -

-

- Winner: WorkOS for a fully hands-off managed service; a tie when Keycloak is - managed by Phase Two. If you need on-premise or strict data control, Keycloak - wins clearly — and it still lets you{" "} - self-host or use managed hosting. -

- - ), - }, - { - title: "Customization and Branding", - body: ( - <> -

- Keycloak offers unparalleled customization and extensibility — from authentication flows - and user federation to role-based access control (RBAC) and fine-grained permissions — - letting organizations tailor the user experience, login screens, and authentication - process to their specific needs. That level of control does require learning the - capabilities of Keycloak. -

-

- WorkOS offers more limited customization options and focuses on providing a unified user - experience across different identity providers. We tip our hats to WorkOS for the - excellent job they've done on design and user experience. -

-

- Winner: Keycloak, by a nose. Keycloak offers complete control over the - look and feel of the authentication and authorization process, while WorkOS does a strong - job of simplifying and constraining the problem for quick implementation. -

+

WorkOS is attractive early: its AuthKit user-management product is free up to a high MAU ceiling, which makes the platform feel inexpensive for B2C-style auth. The cost shows up where WorkOS makes its money — the enterprise features SaaS companies actually sell on, billed per connection.

+

As of 2026, the enterprise building blocks are priced roughly like this:

+ + + + + + + + + +
CapabilityHow it's billedPrice
AuthKit (user management)Per MAUFree to 1M MAU, then ~$2,500/mo per additional 1M
Single Sign-On (SSO)Per connection / month$125 each (tiered down to ~$50 at volume)
Directory Sync (SCIM)Per connection / month$125 each (tiered down to ~$50 at volume)
Audit LogsPer SIEM stream / events$125/mo per stream + $99/mo per 1M events
Custom DomainFlat$99/mo
+

Figures reflect WorkOS's published list pricing as of 2026 (workos.com/pricing); 200+ connections and Enterprise agreements are quote-based.

+

The per-connection model is the catch. Every enterprise customer you onboard typically needs both SSO and SCIM — two separately billed connections — so the bill scales directly with your most valuable B2B customers. A few dozen enterprise logos can turn an "inexpensive" platform into a five- or six-figure annual line item.

+

Keycloak, by contrast, supports unlimited SAML/OIDC identity providers and SCIM directories with no per-connection fee. Your cost is the infrastructure it runs on — fixed, and decoupled from how many enterprise customers you connect.

+

Winner: Keycloak

+

With Phase Two managed hosting, you add enterprise connections without adding line items. See a side-by-side pricing estimate vs. WorkOS.

), }, { - title: "Scalability and Performance", + id: "architecture", + kicker: "02 — Deployment", + title: "Architecture & Deployment", body: ( <> -

- With its robust architecture, Keycloak is designed to handle large-scale user bases, - making it an ideal choice for enterprises. It can be scaled horizontally by adding more - instances or running in clustered mode, ensuring high performance and reliability. - Keycloak is a great platform to unify on for companies with a growing number of - applications that have each taken their own approach to IAM. -

-

- WorkOS offers scalable infrastructure, but it's better suited to small- and medium-sized - applications with moderate-to-high traffic. Its architecture is optimized for efficient - performance but may be less well-equipped for extremely high user-traffic volumes or a - rapidly growing number of connected enterprises. It tends to be stronger when working with - a specific application rather than connecting many applications together. -

-

- Winner: Depends. Keycloak is a strong contender for large-scale - applications looking to scale, while WorkOS may deliver strong performance for small- and - medium-sized apps. -

+

WorkOS is a cloud-based service, so there is little infrastructure to set up. That enables quick deployment and removes much of the DevOps burden. The trade-off is that enterprises with strict regulatory or data-residency requirements often need on-premise options that a SaaS-only model can't fully provide.

+

Keycloak can be deployed on-premise, in your own cloud, or via a managed cloud service. Because you control the deployment environment, it conforms to compliance and data-sovereignty needs and gives you greater control over your security and compliance standards.

+

Winner: Depends

+

If you need on-premise or strict data control, Keycloak wins clearly — and it still gives you the flexibility to self-host or use managed hosting.

), }, { - title: "Functionality and Flexibility", + id: "maintenance", + kicker: "03 — Operations", + title: "Maintenance", body: ( <> -

- Keycloak offers a comprehensive suite of features for modern applications. It provides - secure authentication methods — including username/password, social logins, and MFA — as - well as fine-grained authorization through RBAC and ABAC. Keycloak excels at identity - federation with support for SAML and OpenID Connect, and its SSO feature offers a seamless - experience across applications. It also provides robust user management, customization, - self-registration, and active community support. For any missing functionality,{" "} - extensions can be written and deployed, allowing Keycloak to bend and mold to the - needs of its developers. -

-

- WorkOS offers robust authentication and authorization capabilities, including role-based - access control, policy management, and support for multiple identity standards. Its single - sign-on feature provides a seamless experience across apps and services, and it includes - self-service registration, account recovery, and a comprehensive user directory. - Integration with third-party apps is simplified through APIs and pre-built integrations, - while analytics and logging tools help with monitoring and compliance. -

-

- Winner: Keycloak. Both platforms offer robust functionality, but - Keycloak's advanced identity federation, fine-grained authorization controls, and ability - to customize and extend give it an edge. -

+

A strong advantage of WorkOS is that it's a managed service. From a DevOps perspective, it requires minimal maintenance — the WorkOS team handles updates, security patches, and infrastructure, keeping the system up to date. This comes at a cost, though, since customization is comparatively limited.

+

Self-hosted Keycloak requires more attention: organizations must allocate resources for installing, configuring, and updating the software, as well as managing the underlying infrastructure. This can be a drawback for teams without the necessary expertise. Phase Two removes this trade-off entirely: with managed hosting and zero-downtime upgrades, you get Keycloak's control without the operational load.

+

Winner: WorkOS for self-hosted Keycloak — a tie when Keycloak is managed by Phase Two

), }, { - title: "Integration Capabilities", + id: "functionality", + kicker: "04 — Capability", + title: "Functionality & Flexibility", body: ( <> -

- Keycloak's identity brokering capability lets you delegate authentication to external - identity providers, applications, and protocols such as LDAP, SAML, OAuth, and OpenID - Connect. Managing internal permissions and roles, security checks, and login experiences - across different systems can be done seamlessly. -

-

- WorkOS has a narrower focus on authentication, but it provides a uniform API for - integrating with popular identity providers like Google, Microsoft, and Okta. That unified - interface reduces complexity and development time. -

-

- If you're switching from WorkOS, Keycloak can be configured to act as a broker that sits - between WorkOS and your applications, letting you leverage the strengths of both. For - example, WorkOS can handle external user management while Keycloak handles more sensitive, - internal authentication needs.{" "} - Winner: Keycloak is the most versatile choice for organizations with - complex requirements. -

+

WorkOS is purpose-built for the enterprise-readiness checklist — SSO, Directory Sync (SCIM), Audit Logs, and admin portals — exposed through clean, developer-friendly APIs. It does that job well, but it is intentionally focused: it is not a full identity platform for your own users, and customization stops at the edges of its API.

+

Keycloak covers the same enterprise standards — SAML, OpenID Connect, and SCIM — and adds a complete identity platform on top: your own user store, fine-grained authorization (RBAC and ABAC), social login, MFA, and fully themeable login flows. Being open source, the customization ceiling is the source code itself. A standout capability is Keycloak's on-premise deployment options.

+

Winner: Keycloak

+

WorkOS is excellent at the slice it covers; Keycloak covers that slice and the rest of your identity needs in one deployment.

), }, { - title: "Community and Support", + id: "integrating", + kicker: "05 — Interop", + title: "Integrating Keycloak with external systems like WorkOS", body: ( <> -

- Keycloak has a large and active community of developers and contributors, ensuring - continuous development, bug fixes, and updates. It has extensive documentation, forums, - and{" "} - - community support channels - {" "} - where users can seek help and share knowledge. WorkOS also provides support but may have - limitations in terms of community contributions and public resources; it offers dedicated - support channels and resources for assistance and issue resolution. -

-

- Working with Phase Two gives you some of the best of both worlds: easy integration with - the ability to scale without incurring additional costs. If you have questions about Phase - Two's enterprise support, we're happy to help. -

+

For organizations looking to transition from WorkOS to Keycloak — or to integrate Keycloak with systems already using WorkOS — Keycloak's flexibility offers a significant advantage. Keycloak can act as a broker that sits between WorkOS and your applications, letting you leverage the strengths of both platforms during a transition.

+

Keycloak's identity-brokering capability lets it delegate authentication to external identity providers (IdPs) such as WorkOS. Keycloak can manage internal permissions and roles, provide additional security checks, and maintain a consistent, user-friendly login experience across systems. This makes migrating off WorkOS a low-risk, phased process — you can move one piece at a time without disrupting user access or security.

), }, { - title: "Migrating from WorkOS to Keycloak", + id: "best", + kicker: "06 — Verdict", + title: "Which IAM solution is best for me?", body: ( <> -

- Moving off WorkOS is more approachable than many teams expect. Keycloak imports users, - supports gradual cutover, and brokers identities so you can transition without disrupting - access — see Migrate to Keycloak. -

-

- You can also run Keycloak alongside WorkOS during a transition: Keycloak can act - as a broker that sits between WorkOS and your applications. That lets you keep existing - WorkOS connections — for example, for external user management — while Keycloak handles - internal permissions, roles, and a consistent login experience. It's a low-risk path to - migrating one piece at a time. For teams with strict requirements, Keycloak's{" "} - on-premise deployment options are a standout advantage - over a cloud-only platform. -

+

WorkOS is a strong fit for SaaS teams that want to ship enterprise SSO and SCIM fast and are comfortable paying per connection as they add enterprise customers. For teams that want to avoid per-connection costs, own their user data, or need on-premise deployment, Keycloak is the more flexible and cost-stable choice.

+

At Phase Two, we run Keycloak so you don't have to — combining the open standards WorkOS is known for with a complete, self-ownable identity platform and a fixed, predictable cost. We offer robust Keycloak hosting, migration, and support.

), }, ]; +const matrix = { + savings: "~80%", + rows: [ + { feat: "Per-connection pricing penalty", vendor: "$$$", keycloak: "lim" }, + { feat: "Open-source core", vendor: "no", keycloak: "yes" }, + { feat: "Self-hostable (no lock-in)", vendor: "no", keycloak: "yes" }, + { feat: "On-premise / data residency", vendor: "no", keycloak: "yes" }, + { feat: "Unlimited IdP connections without per-seat fees", vendor: "$$$", keycloak: "yes" }, + { feat: "Custom SAML / OIDC IdPs & SCIM", vendor: "yes", keycloak: "yes" }, + { feat: "Full source access & SPI extensions", vendor: "lim", keycloak: "yes" }, + { feat: "Federate / broker existing IdP", vendor: "lim", keycloak: "yes" }, + { feat: "24/7 escalation with Keycloak experts", vendor: "lim", keycloak: "yes" }, + ], +}; + const faqs = [ { q: "Is Keycloak a good alternative to WorkOS?", - a: ( -

- Yes. Keycloak supports the same core standards as WorkOS (OAuth 2.0, OpenID Connect, SAML, - and SCIM) and matches it on most authentication and authorization features, while being open - source and free of per-user, per-connection licensing. It also offers far greater - customization and extensibility. The main trade-off is operational overhead, which a managed - host like Phase Two removes. -

- ), - text: - "Yes. Keycloak supports the same core standards as WorkOS (OAuth 2.0, OpenID Connect, SAML, and SCIM) and matches it on most features, while being open source and free of per-user, per-connection licensing. It also offers far greater customization and extensibility. The main trade-off is operational overhead, which a managed host like Phase Two removes.", + a:

Yes. Keycloak supports the same enterprise standards as WorkOS — SAML, OpenID Connect, and SCIM — and adds a full identity platform (your own users, RBAC/ABAC, MFA, themeable login), while being open source and free of per-connection licensing.

, + text: "Yes. Keycloak supports the same enterprise standards as WorkOS — SAML, OpenID Connect, and SCIM — and adds a full identity platform (your own users, RBAC/ABAC, MFA, themeable login), while being open source and free of per-connection licensing.", }, { q: "Is Keycloak cheaper than WorkOS?", - a: ( -

- For most growing applications, yes. WorkOS pricing scales with monthly active users and - adds per-feature charges for things like SSO connections, SCIM, custom domains, and audit - logs, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as - your user base and connections grow. Because cost isn't tied to features or users, the - ongoing spend is predictable. -

- ), - text: - "For most growing applications, yes. WorkOS pricing scales with monthly active users and adds per-feature charges for SSO connections, SCIM, custom domains, and audit logs, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base and connections grow.", + a:

For teams with many enterprise customers, usually yes. WorkOS bills per SSO/SCIM connection, so cost scales with your B2B logos. Keycloak supports unlimited connections and is priced on infrastructure, which stays largely fixed as you grow.

, + text: "For teams with many enterprise customers, usually yes. WorkOS bills per SSO/SCIM connection, so cost scales with your B2B logos. Keycloak supports unlimited connections and is priced on infrastructure, which stays largely fixed as you grow.", }, { q: "Can I migrate from WorkOS to Keycloak?", - a: ( -

- Yes. Keycloak can import your users and broker authentication to WorkOS during a phased - cutover, so you can migrate incrementally without disrupting users. You can even run - Keycloak as a broker in front of WorkOS to leverage both platforms during the transition. - See Migrate to Keycloak. -

- ), - text: - "Yes. Keycloak can import your users and broker authentication to WorkOS during a phased cutover, so you can migrate incrementally without disrupting users. You can even run Keycloak as a broker in front of WorkOS during the transition.", + a:

Yes. Keycloak can broker or replace WorkOS connections during a phased cutover, so you can move enterprise customers across incrementally without disrupting their SSO. See Migrate to Keycloak.

, + text: "Yes. Keycloak can broker or replace WorkOS connections during a phased cutover, so you can move enterprise customers across incrementally without disrupting their SSO.", }, { - q: "Does Keycloak support SAML, OIDC, OAuth 2.0, and SCIM?", - a: ( -

- Yes. Keycloak is built on these standards and interoperates with both modern applications - and legacy systems, including LDAP and Active Directory. Its identity brokering lets you - delegate authentication to external identity providers like Google, Microsoft, and Okta. -

- ), - text: - "Yes. Keycloak is built on these standards and interoperates with both modern applications and legacy systems, including LDAP and Active Directory. Its identity brokering lets you delegate authentication to external identity providers like Google, Microsoft, and Okta.", + q: "Does Keycloak support SAML, OIDC, and SCIM?", + a:

Yes. Keycloak is built on SAML and OpenID Connect, supports unlimited identity-provider connections, and offers SCIM directory provisioning through extensions.

, + text: "Yes. Keycloak is built on SAML and OpenID Connect, supports unlimited identity-provider connections, and offers SCIM directory provisioning through extensions.", }, { q: "Can Keycloak be self-hosted or run on-premise?", - a: ( -

- Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This - flexibility is a key advantage over WorkOS's cloud-only model, especially for data-residency - and compliance requirements. -

- ), - text: - "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service. This flexibility is a key advantage over WorkOS's cloud-only model, especially for data-residency and compliance requirements.", + a:

Yes. Keycloak can run on-premise, in your own cloud, or as a managed service — a key advantage over WorkOS's cloud-only model for data-residency and compliance.

, + text: "Yes. Keycloak can run on-premise, in your own cloud, or as a managed service — a key advantage over WorkOS's cloud-only model for data-residency and compliance.", }, ]; +const migration = { + heading: "Already using WorkOS?", + body: "Moving to Keycloak is more approachable than most teams expect. We import users, broker authentication during a phased cutover, and move you off WorkOS without disrupting access.", +}; + +const bigcta = { + heading: "See how much you'd save.", + body: "A 30-minute demo and a custom proposal — keyed to your current WorkOS contract — usually beats your renewal.", +}; + export default function KeycloakVsWorkOS() { return ( ); } diff --git a/static/img/comparison/logo_phase_slash_white.svg b/static/img/comparison/logo_phase_slash_white.svg new file mode 100644 index 00000000..7a330acd --- /dev/null +++ b/static/img/comparison/logo_phase_slash_white.svg @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/static/img/comparison/phasetwo_logo_icon.svg b/static/img/comparison/phasetwo_logo_icon.svg new file mode 100644 index 00000000..1bbebbac --- /dev/null +++ b/static/img/comparison/phasetwo_logo_icon.svg @@ -0,0 +1,10 @@ + + + + + + + + + + \ No newline at end of file From 045d14647e592393759d1f9e23ac56e323063ba4 Mon Sep 17 00:00:00 2001 From: pnzrp2 Date: Wed, 1 Jul 2026 13:14:18 -0600 Subject: [PATCH 3/3] use workos over cognito --- docusaurus.config.js | 2 +- .../diagrams/UserMigrationDiagram.jsx | 2 +- .../support-pricing-sections.jsx | 2 +- src/pages/extensions/user-migration.jsx | 90 +++++++++++++++---- src/pages/keycloak-alternatives.jsx | 4 +- src/pages/support/index.jsx | 2 +- 6 files changed, 78 insertions(+), 24 deletions(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index 147f2058..67516f7d 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -371,7 +371,7 @@ module.exports = { { label: "Migration to Keycloak", to: "support/migrate-to-keycloak", - sub: "Move off Auth0, Okta, Cognito", + sub: "Move off Auth0, Okta, WorkOS", icon: "migrate", }, { diff --git a/src/components/extensions/diagrams/UserMigrationDiagram.jsx b/src/components/extensions/diagrams/UserMigrationDiagram.jsx index 62b7b154..d590c93b 100644 --- a/src/components/extensions/diagrams/UserMigrationDiagram.jsx +++ b/src/components/extensions/diagrams/UserMigrationDiagram.jsx @@ -21,7 +21,7 @@ export default function UserMigrationDiagram() { LEGACY - Auth0 · Cognito + Auth0 · WorkOS REST API · LDAP · SQL {Array.from({ length: 12 }).map((_, i) => ( diff --git a/src/components/keycloak-support-packages/support-pricing-sections.jsx b/src/components/keycloak-support-packages/support-pricing-sections.jsx index 5de32396..c53d8726 100644 --- a/src/components/keycloak-support-packages/support-pricing-sections.jsx +++ b/src/components/keycloak-support-packages/support-pricing-sections.jsx @@ -143,7 +143,7 @@ export function SupportTierCards() { const SERVICES = [ { t: "Migration to Keycloak", - d: "Move off Auth0, Okta, or Cognito with zero password resets.", + d: "Move off Auth0, Okta, or WorkOS with zero password resets.", }, { t: "Architecture & scaling review", diff --git a/src/pages/extensions/user-migration.jsx b/src/pages/extensions/user-migration.jsx index 0d210ab5..d2164ff1 100644 --- a/src/pages/extensions/user-migration.jsx +++ b/src/pages/extensions/user-migration.jsx @@ -17,44 +17,98 @@ const CONTENT = { hero: { h1: "Move to Keycloak without forcing a password reset.", lead: "A federation provider that validates first-login credentials against your legacy IdP, then transparently migrates users to Keycloak. No mass email, no support hit.", - badges: ["Lazy Migration", "Auth0 · Cognito · REST · LDAP · SQL", "No Reset Emails", "Transparent To Users"], + badges: [ + "Lazy Migration", + "Auth0 · WorkOS · REST · LDAP · SQL", + "No Reset Emails", + "Transparent To Users", + ], }, problem: { heading: "Migrating to a new IdP usually means breaking your users.", cards: [ - { title: "Password hashes don't move", body: "Most legacy IdPs won't export password hashes. The 'easy' path is to email everyone a reset — and watch your active user count crater." }, - { title: "Big-bang migrations are risky", body: "Cutting all users over in one weekend leaves no rollback, no canary, and a worst-case support load." }, - { title: "Long tail of inactive accounts", body: "You'd rather not migrate the 30% of users who haven't logged in this year. But which 30%?" }, + { + title: "Password hashes don't move", + body: "Most legacy IdPs won't export password hashes. The 'easy' path is to email everyone a reset — and watch your active user count crater.", + }, + { + title: "Big-bang migrations are risky", + body: "Cutting all users over in one weekend leaves no rollback, no canary, and a worst-case support load.", + }, + { + title: "Long tail of inactive accounts", + body: "You'd rather not migrate the 30% of users who haven't logged in this year. But which 30%?", + }, ], }, approach: { heading: "Migrate on first login, transparently", cards: [ - { title: "Federation, not export", body: "Keycloak federates to your legacy system. First-login auth happens there." }, - { title: "Validate, then import", body: "If the legacy system says the password is right, we create a local Keycloak account with the profile." }, - { title: "Subsequent logins are local", body: "After the first login, the user authenticates against Keycloak directly. Legacy IdP becomes optional." }, - { title: "Inactive users self-select out", body: "Anyone who never logs in is never migrated. Cleanup happens organically." }, + { + title: "Federation, not export", + body: "Keycloak federates to your legacy system. First-login auth happens there.", + }, + { + title: "Validate, then import", + body: "If the legacy system says the password is right, we create a local Keycloak account with the profile.", + }, + { + title: "Subsequent logins are local", + body: "After the first login, the user authenticates against Keycloak directly. Legacy IdP becomes optional.", + }, + { + title: "Inactive users self-select out", + body: "Anyone who never logs in is never migrated. Cleanup happens organically.", + }, ], }, useCases: { heading: "Whose migrations get easier", - intro: "Anyone moving off Auth0, Cognito, a custom database, LDAP, or any legacy IdP — without a 6-month coordinated cutover.", + intro: + "Anyone moving off Auth0, WorkOS, a custom database, LDAP, or any legacy IdP — without a 6-month coordinated cutover.", items: [ - { title: "Auth0 / Okta exit", sub: "Most common path — federate, then migrate." }, - { title: "Cognito → Keycloak", sub: "Federation hits the Cognito user pool." }, + { + title: "Auth0 / Okta exit", + sub: "Most common path — federate, then migrate.", + }, + { + title: "WorkOS → Keycloak", + sub: "Federation hits the WorkOS user pool.", + }, { title: "Legacy SQL user table", sub: "Bring-your-own REST endpoint." }, - { title: "LDAP consolidation", sub: "Standard LDAP federation, lazy-migrated." }, + { + title: "LDAP consolidation", + sub: "Standard LDAP federation, lazy-migrated.", + }, ], }, capabilities: { heading: "Everything you'd want from a migration", items: [ - { title: "Bring-your-own REST endpoint", body: "Implement a tiny endpoint that takes username+password, returns a profile." }, - { title: "Auth0 / Cognito connectors", body: "Pre-built integrations for the most common sources." }, - { title: "LDAP / SQL federation", body: "Stock Keycloak federation patterns, batteries included." }, - { title: "Profile mapping", body: "Map legacy attributes to Keycloak attributes — name, email, custom." }, - { title: "Migration progress dashboard", body: "See how many users have migrated, who's left, when the tail flatlines." }, - { title: "Cut-over when you're ready", body: "Once migration % is high enough, disable federation and run pure Keycloak." }, + { + title: "Bring-your-own REST endpoint", + body: "Implement a tiny endpoint that takes username+password, returns a profile.", + }, + { + title: "Auth0 / WorkOS connectors", + body: "Pre-built integrations for the most common sources.", + }, + { + title: "LDAP / SQL federation", + body: "Stock Keycloak federation patterns, batteries included.", + }, + { + title: "Profile mapping", + body: "Map legacy attributes to Keycloak attributes — name, email, custom.", + }, + { + title: "Migration progress dashboard", + body: "See how many users have migrated, who's left, when the tail flatlines.", + }, + { + title: "Cut-over when you're ready", + body: "Once migration % is high enough, disable federation and run pure Keycloak.", + }, ], }, }; diff --git a/src/pages/keycloak-alternatives.jsx b/src/pages/keycloak-alternatives.jsx index 9141af94..f2fb6db5 100644 --- a/src/pages/keycloak-alternatives.jsx +++ b/src/pages/keycloak-alternatives.jsx @@ -62,7 +62,7 @@ const FAQS = [ text: "For most growing applications, yes. Commercial IAM pricing scales with monthly active users and feature tiers, while Keycloak's cost is driven by hosting infrastructure and stays largely fixed as your user base grows.", }, { - q: "Can I migrate off Auth0, Okta, or Cognito to Keycloak?", + q: "Can I migrate off Auth0, Okta, or WorkOS to Keycloak?", a:

Yes. Keycloak can import your users and broker authentication to your existing provider during a phased cutover, so you can migrate incrementally without disrupting users. We've built tooling and a process for exactly this — see Migrate to Keycloak.

, text: "Yes. Keycloak can import your users and broker authentication to your existing provider during a phased cutover, so you can migrate incrementally without disrupting users.", }, @@ -216,7 +216,7 @@ export default function KeycloakAlternatives() {
Migration
-

Already on Auth0, Okta, or Cognito?

+

Already on Auth0, Okta, or WorkOS?

Moving to Keycloak is more approachable than most teams expect. We import users, broker authentication during a phased cutover, and move you off your current vendor without disrupting access.

See how we migrate teams to Keycloak
diff --git a/src/pages/support/index.jsx b/src/pages/support/index.jsx index 3e634a8f..5e331b4b 100644 --- a/src/pages/support/index.jsx +++ b/src/pages/support/index.jsx @@ -64,7 +64,7 @@ const TOP_BENEFITS = [ description: (

- Migrate from Okta, Auth0, WorkOS, Cognito + Migrate from Okta, Auth0, WorkOS, PingIdentity , or other providers with confidence. We support any Keycloak version, including RHBK, from initial testing through production launch.