Luca BertonIdentity: The Security Foundation
Keycloak vs Okta, in short: Keycloak is a self-hosted, open source identity provider ā full data sovereignty and no per-user licensing, at the cost of owning the operations. Okta is a SaaS workforce identity platform ā the widest pre-built SSO integration catalogue and low operational overhead, priced per user. Auth0, now part of Okta, targets customer-facing identity rather than workforce SSO. Identity and access management is the single most critical security component. Every authentication decision, every authorisation check, every API token flows through your identity provider. For regulated enterprises, the choice between self-hosted (Keycloak) and SaaS (Auth0, Okta) affects data sovereignty, compliance posture, and operational risk.
Platform Comparison
Keycloak
- Type: Open source (CNCF project), self-hosted
- Protocols: OIDC, SAML 2.0, OAuth 2.0, LDAP federation
- MFA: TOTP, WebAuthn/FIDO2, SMS (via SPI)
- Data sovereignty: Complete ā runs on your infrastructure, all identity data stays internal
- Customisation: Extensive ā themes, SPIs, custom authenticators, user federation
- Scalability: Horizontal with Infinispan clustering. Requires operational expertise.
- Cost: Free (infrastructure + operations cost). Red Hat SSO provides commercial support.
Auth0 (Okta)
- Type: SaaS (acquired by Okta in 2021, but operates as separate product)
- Protocols: OIDC, SAML 2.0, OAuth 2.0
- MFA: TOTP, push notifications, WebAuthn, SMS, email
- Data sovereignty: Multiple regions including EU. Private Cloud option for dedicated deployment.
- Developer experience: Best-in-class SDKs, documentation, and quickstarts
- Extensibility: Actions (serverless hooks), custom database connections, social logins
- Cost: Free tier (7,500 MAU). Professional from $240/mo. Enterprise pricing custom.
Okta (Workforce Identity)
- Type: SaaS (publicly traded, market leader)
- Protocols: OIDC, SAML 2.0, OAuth 2.0, SCIM
- MFA: Okta Verify, FIDO2, SMS, email, third-party MFA
- Focus: Workforce identity (employee SSO, lifecycle management, governance)
- Integration: 7,500+ app integrations. Strongest pre-built SSO catalogue.
- Compliance: SOC 2 Type II, ISO 27001, FedRAMP, HIPAA BAA
- Cost: From $2-6/user/month. Enterprise features in higher tiers.
Decision Guide
| Factor | Keycloak | Auth0 | Okta |
|---|---|---|---|
| Data sovereignty | ā Full control | ā ļø EU region / Private Cloud | ā ļø EU cell available |
| Best for | Full control, air-gapped | Customer-facing apps | Employee workforce SSO |
| Ops burden | High (1-2 FTE) | Low | Low |
| Cost at 10K users | ~$1-3K/mo infra | ~$1-3K/mo | ~$2-6K/mo |
| Vendor lock-in | None (OIDC/SAML standards) | Medium (Actions, Rules) | Medium (integrations) |
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare āRecommendation
- Choose Keycloak if: Data sovereignty is non-negotiable (financial services, government, defence), you need air-gapped deployment, or you want full control over authentication flows.
- Choose Auth0 if: You're building customer-facing applications, developer experience matters, and EU data residency (not full sovereignty) is acceptable.
- Choose Okta if: Your primary need is employee SSO across many SaaS applications, you want the widest pre-built integration catalogue, and you value workforce lifecycle management (joiner/mover/leaver).
- Common pattern: Keycloak for internal/sensitive applications + Okta for SaaS SSO. Federate between them.