OpenAM vs Keycloak
| |
OpenAM |
Keycloak |
| Initial release |
2008 |
2014 |
| Maintainer |
Open Identity Platform Community |
Red Hat |
| Current version |
16.0.4 |
26.4.7 |
| Release and patches |
Regular |
Regular |
| Open Source |
✅ |
✅ |
| Programming Language |
Java |
Java |
| Supported Java version |
11+ LTS |
17+ LTS |
| License |
CDDL |
Apache License 2.0 |
| Multiple languages supported |
✅ |
✅ |
Single Sign On (SSO) and Federation
Authentication
Supported authentication methods:
| Authentication method |
OpenAM |
Keycloak |
| Login and password authentication |
✅ doc |
✅ doc |
| Microsoft Active Directory authentication |
✅ doc |
✅ doc |
| Authentication for demo access |
✅ doc |
⛔️ |
| Adaptive authentication |
✅ doc |
⛔️ |
| Authentication in an LDAPv3-compatible directory |
✅ doc |
✅ doc |
| Persistent cookie authentication |
✅ doc |
✅ doc |
| RDBMS authentication |
✅ doc |
✅ doc |
| Self-registration |
✅ doc |
✅ doc |
| HTTP Header enrichment authentication |
✅ doc |
⛔️ |
| Windows NT authentication |
✅ doc |
⛔️ |
| OAuth 2.0/OIDC authentication |
✅ doc |
✅ doc |
| Kerberos authentication |
✅ doc |
✅ doc |
| OIDC id_token authentication |
✅ doc |
⛔️ |
| RADIUS authentication |
✅ doc |
⛔️ |
| HOTP via SMS or email |
✅ doc |
⛔️ |
| One time password with HOTP or TOTP authentication |
✅ doc |
✅ doc |
| Custom scripted authentication provider |
✅ doc |
⛔️ |
| SAMLv2 authentication |
✅ doc |
✅ doc |
| ReCaptcha |
✅ doc |
✅ doc |
| QR-code authentication |
✅ doc |
⛔️ |
| NTLM authentication |
✅ doc |
⛔️ |
| Docker HTTP Basic Authentication |
⛔️ |
✅ doc |
| HTTP Basic Authentication |
✅ doc |
✅ doc |
| Recovery codes authentication |
✅ doc |
✅ doc |
| WebAuthn |
✅ doc |
✅ doc |
| X509 certificate authentication |
✅ doc |
✅ doc |
| Custom authentication provider |
✅ doc |
✅ doc |
Isolation (realms)
Realm support for isolation of identities and authentication processes
| |
OpenAM |
Keycloak |
| Realms support |
✅ doc |
✅ doc |
| Realm hierarchy |
✅ |
⛔️ |
Interfaces
| Interface |
OpenAM |
Keycloak |
| Administrator GUI |
✅ |
✅ |
| Admin REST API |
✅ |
✅ |
| Admin UI customization |
⛔️ |
✅ doc |
| Authentication GUI |
✅ |
✅ |
| Authentication GUI customization |
✅ doc |
✅ doc |
| Authentication REST API |
✅ doc |
⛔️ |
| Authentication XML-RPC API |
✅ doc |
⛔️ |
Authentication Sessions
| |
OpenAM |
Keycloak |
| Stateful |
Random session ID |
JWT |
| Stateless |
JWT |
JWT |
| REST Security Token Service |
✅ |
✅ |
| SOAP Security Token Service |
✅ |
⛔️ |
Identity Repositories
| Repository type |
OpenAM |
Keycloak |
| LDAP (OpenDJ, OpenLDAP, etc.) |
✅ |
✅ |
| Active Directory |
✅ |
✅ |
| Apache Cassandra |
✅ |
⛔️ |
| MariaDB Server |
✅ |
✅ |
| Microsoft SQL Server |
✅ |
✅ |
| MySQL |
✅ |
✅ |
| Oracle Database |
✅ |
✅ |
| PostgreSQL |
✅ |
✅ |
| Flat file |
✅ |
⛔️ |
| Custom identity repository |
✅ doc |
✅ doc |
Audit logging and Monitoring
| |
OpenAM |
Keycloak |
| Audit Logging |
✅ doc |
✅ doc |
| HTTP-based Monitoring |
✅ doc |
✅ doc |
| SNMP Monitoring |
✅ doc |
⛔️ |
| JMX Monitoring |
✅ doc |
⛔️ |
Summary
Both OpenAM and Keycloak are mature, standards-based, open-source IAM platforms, and either can anchor a serious SSO deployment. The right choice depends on your context rather than a single winner:
- Choose OpenAM if you need breadth of authentication modules and adaptive/chained authentication, protocols such as UMA 2.0, SNMP/JMX monitoring, policy agents for web/app servers, or a drop-in continuation of a ForgeRock-based architecture.
- Choose Keycloak if you want a newer admin UI out of the box and are already invested in the Red Hat / Quarkus ecosystem.
If you’d like help matching either platform to your requirements, or planning a migration, independent vendors offer paid consulting and implementation — see the Support & Services page for options, while community help stays free on GitHub. Moving off a ForgeRock stack? OpenAM is a like-for-like open-source continuation — see the ForgeRock alternative & migration path.
Useful Links
OpenAM:
Keycloak: