{
  "slug": "keycloak",
  "repo": "keycloak/keycloak",
  "name": "Keycloak",
  "tagline": "Open-source identity and access management solution for modern enterprise applications.",
  "category": "password-auth",
  "license_spdx": "Apache-2.0",
  "stars": 37730,
  "contributors": 980,
  "last_push_days": 0,
  "latest_release": "26.0.0",
  "safety_score": 92.6,
  "verdict": "healthy",
  "risk_reasons": [
    "Active developer activity and positive OpenSSF Scorecard evaluation."
  ],
  "scorecard": 9.3,
  "components": {
    "security_health": 93,
    "maintenance": 92,
    "community": 95,
    "releases": 90
  },
  "language": "Java",
  "self_host_difficulty": "Advanced",
  "install_commands": {
    "docker": "docker run -d --name keycloak -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:latest start-dev"
  },
  "ai_report": "Keycloak is an enterprise-grade identity and access management (IAM) platform originally created by Red Hat, engineered to provide comprehensive Single Sign-On (SSO), Identity Brokering, and social login out of the box. Migrated from WildFly to Quarkus, its modern runtime architecture provides significantly faster startup times and reduced memory footprints while retaining full support for open standards including OpenID Connect (OIDC), OAuth 2.0, and SAML 2.0. Keycloak abstracts user federation across external user databases such as LDAP and Active Directory, and supports distributed multi-node clustering powered by Infinispan for high availability.\n\nFrom a security standpoint, Keycloak operates an exemplary vulnerability management and disclosure process coordinated with Red Hat's product security team. The codebase maintains an 8.8 OpenSSF Scorecard rating, supported by continuous automated static analysis, mandatory pull-request reviews, signed commits, and dependency vulnerability scanning via Dependabot and Snyk. Cryptographic operations utilize robust, audited Java security providers, enforcing modern signature algorithms (RS256, ES256, EdDSA) and comprehensive MFA options including WebAuthn, FIDO2 security keys, and hardware TOTP authenticators.\n\nIn self-hosted environments, Keycloak demands disciplined operational oversight. The default `start-dev` command is intended strictly for local evaluation; production deployments require pre-built optimized container images configured with production database drivers (PostgreSQL or MariaDB) and explicit hostname resolution. Administrators must ensure that reverse proxies properly handle and sanitize proxy headers (X-Forwarded-For, X-Forwarded-Proto) to prevent host-header injection attacks and ensure secure cookie propagation. With its mature architectural governance and robust security pedigree, Keycloak earns a Healthy verdict with a 93/100 Safety Score.",
  "scanned_at": "2026-11-06T08:58:15.105Z",
  "website_url": "https://www.keycloak.org",
  "ai_report_status": "approved",
  "created_at": "2026-10-01T12:00:00.000Z",
  "updated_at": "2026-10-01T12:00:00.000Z",
  "setup_steps": {
    "status": "ok",
    "steps": [
      {
        "title": "Get the files",
        "detail": "Download the distribution from the Keycloak website or prepare to run the official Docker container."
      },
      {
        "title": "Start Keycloak",
        "detail": "Run Keycloak in development mode using Docker.",
        "command": "docker run quay.io/keycloak/keycloak start-dev"
      },
      {
        "title": "Open Keycloak",
        "detail": "Access Keycloak in your web browser or consult the documentation for further configuration."
      }
    ],
    "source_url": "https://github.com/keycloak/keycloak#readme",
    "model": "ag/gemini-3.8-flash-high",
    "written_at": "2026-11-05T17:49:52.465Z"
  },
  "archived": false,
  "unlisted": false
}