Luca BertonIdentity: The Security Foundation
Keycloak vs Okta: Choose based on your sovereignty and integration needs. Keycloak is self-hosted, open source identity ā full data control, no per-user licensing, but you operate it. Okta is SaaS workforce identity ā 7,500+ pre-built integrations, low operational overhead, priced per user. Auth0 (now Okta-owned) targets customer-facing identity rather than workforce SSO. For regulated enterprises, this choice between self-hosted Keycloak and managed Okta directly affects data sovereignty, compliance posture, and operational risk. Identity and access management is the single most critical security component ā every authentication decision, authorisation check, and API token flows through your identity provider.
Platform Comparison
Keycloak: Self-Hosted Sovereignty vs Okta's SaaS
- Type: Open source (CNCF project), self-hosted ā unlike Okta's managed SaaS
- Protocols: OIDC, SAML 2.0, OAuth 2.0, LDAP federation
- MFA: TOTP, WebAuthn/FIDO2, SMS (via SPI)
- Data sovereignty: Complete ā runs on your infrastructure, all identity data stays internal
- Customisation: Extensive ā themes, SPIs, custom authenticators, user federation
- Scalability: Horizontal with Infinispan clustering. Requires operational expertise.
- Cost: Free (infrastructure + operations cost). Red Hat SSO provides commercial support.
Auth0 (Okta)
- Type: SaaS (acquired by Okta in 2021, but operates as separate product)
- Protocols: OIDC, SAML 2.0, OAuth 2.0
- MFA: TOTP, push notifications, WebAuthn, SMS, email
- Data sovereignty: Multiple regions including EU. Private Cloud option for dedicated deployment.
- Developer experience: Best-in-class SDKs, documentation, and quickstarts
- Extensibility: Actions (serverless hooks), custom database connections, social logins
- Cost: Free tier (7,500 MAU). Professional from $240/mo. Enterprise pricing custom.
Okta (Workforce Identity)
- Type: SaaS (publicly traded, market leader)
- Protocols: OIDC, SAML 2.0, OAuth 2.0, SCIM
- MFA: Okta Verify, FIDO2, SMS, email, third-party MFA
- Focus: Workforce identity (employee SSO, lifecycle management, governance)
- Integration: 7,500+ app integrations. Strongest pre-built SSO catalogue.
- Compliance: SOC 2 Type II, ISO 27001, FedRAMP, HIPAA BAA
- Cost: From $2-6/user/month. Enterprise features in higher tiers.
Decision Guide
| Factor | Keycloak | Auth0 | Okta |
|---|---|---|---|
| Data sovereignty | ā Full control | ā ļø EU region / Private Cloud | ā ļø EU cell available |
| Best for | Full control, air-gapped | Customer-facing apps | Employee workforce SSO |
| Ops burden | High (1-2 FTE) | Low | Low |
| Cost at 10K users | ~$1-3K/mo infra | ~$1-3K/mo | ~$2-6K/mo |
| Vendor lock-in | None (OIDC/SAML standards) | Medium (Actions, Rules) | Medium (integrations) |
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare āRecommendation
- Choose Keycloak if: Data sovereignty is non-negotiable (financial services, government, defence), you need air-gapped deployment, or you want full control over authentication flows.
- Choose Auth0 if: You're building customer-facing applications, developer experience matters, and EU data residency (not full sovereignty) is acceptable.
- Choose Okta if: Your primary need is employee SSO across many SaaS applications, you want the widest pre-built integration catalogue, and you value workforce lifecycle management (joiner/mover/leaver).
- Common pattern: Keycloak for internal/sensitive applications + Okta for SaaS SSO. Federate between them.