Keycloak

Keycloak is our preferred Identity and Access Management (IAM) solution for our Common Ground projects, and more generally whenever we do not want to depend on similar IAM SaaS cloud services.

It is the choice when several applications share users, or when single sign-on and identity federation are needed. For authentication inside a single application we use better-auth, as part of our TypeScript stack and tooling.

In one project we use ZITADEL as a lighter alternative: PostgreSQL-only, with multi-tenancy built in. It is open source under AGPL 3.0 since 2025, from a Swiss company. Keycloak remains our default.

In the past we have been using Keycloak as our preferred Identity and Access Management (IAM) solution. We found this to be a very good fit with our on-premise hosting services.

But now that we prefer to host our solutions on cloud-native platforms and use (SaaS) cloud services where it makes sense, we find that Keycloak is no longer the best fit for our needs and therefore we now prefer the IAM services offered by our cloud platform.

In the past we have been using Keycloak as our preferred Identity and Access Management (IAM) solution. We found this to be a very good fit with our on-premise hosting services.

But now that we prefer to host our solutions on cloud-native platforms and use (SaaS) cloud services where it makes sense, we find that Keycloak is no longer the best fit for our needs and therefore we now prefer the IAM services that AWS offers (AWS IAM and Amazon Cognito) while also trialling the SaaS IAM service Clerk.