Fully Managed Open Source Identity Providers: Buyer's Guide

Fully Managed Open Source Identity Providers: Buyer's Guide. What a fully managed open source identity provider is, which IdPs are really open source, and how managed Keycloak, ZITADEL, Ory, authentik and Logto compare.

A fully managed open source identity provider is an open source IdP, such as Keycloak, run for you as a hosted service: the vendor handles upgrades, patching, scaling and backups, while you keep standard protocols and the option to self-host the same software later. Skycloak offers this for Keycloak, and Cloud-IAM and Phase Two are other managed Keycloak options. ZITADEL, Ory and Logto sell hosted versions of their own open source projects, and authentik is offered by third-party hosts.

This guide is for engineering leads and platform teams who already know OIDC and SAML, have looked at Keycloak, and do not want to operate an identity server themselves. It compares the open source IdPs that have a managed offering on four things that decide whether “open source” still means something once someone else runs it: the license, what “fully managed” covers, how you leave, and how the price grows. A quick disclosure: we run Skycloak, a managed Keycloak service, so we have placed ourselves in the comparison with only the claims our public pages and docs make.

What does “fully managed” actually cover?

“Fully managed” should mean the provider carries the operational work you would otherwise staff for. For an identity provider that is four jobs: upgrading to new releases, applying security patches when a CVE lands, keeping backups you can restore, and answering when sign-in breaks at night. If any of those four stays with you, you are buying hosting, not a managed service.

It helps to separate this from two things that look similar. A supported distribution, such as Red Hat build of Keycloak, gives you tested binaries and a support contract, but your team still runs the cluster. A one-click install on a generic cloud gets a container running for you, but upgrades and incidents come back to you on day two. We walk through those shapes in more detail in our comparison of managed Keycloak providers.

When you read a provider’s page, look for each of the four jobs in writing:

• Upgrades: who performs them, how much notice you get, and whether you can pin a version while you test.
• Patches: how quickly a security fix reaches your instance after it is released.
• Backups: how often they run, how long they are kept, and whether you can download one and restore it somewhere else.
• On-call: which support hours apply to your plan, and whether the uptime figure is a contractual SLA with service credits or a target. Our post on how many nines a Keycloak SLA really needs explains what each figure allows in downtime.

Which identity providers are really open source?

“Open source” has a precise meaning. The Open Source Definition lists criteria that include free redistribution, included source code, allowing derived works, and no discrimination against persons, groups or fields of endeavor. A license that forbids offering the software as a hosted service, or that requires a paid subscription for production use, does not meet it, even if the code is public. That matters to you because the license is what guarantees you can take the same software and run it yourself if the managed service stops suiting you.

Here is where the products that come up in this category stand, from their own repositories and license pages:

• Keycloak is licensed under Apache 2.0 (the Keycloak repository) and was accepted to the CNCF at the incubating level in April 2023, so no single vendor controls it.
• ZITADEL is moving from Apache 2.0 to AGPL 3.0 starting with version 3, according to its licensing FAQ. AGPL is an open source license, but it requires you to publish your changes if you modify ZITADEL and offer it over a network, so legal teams often want to review it. The source is in the ZITADEL repository.
• Ory says its core services, including Kratos (identity), Hydra (OAuth2 and OIDC), Keto (permissions) and Oathkeeper, remain open source under Apache 2.0 (Ory open source, the Kratos repository). The same page also offers the Ory Enterprise License for self-hosting Ory with 24x7 support.
• authentik is open core: its LICENSE file puts most of the code under MIT, while the code in its enterprise directory is under the separate license in that directory (the authentik repository). The open source part is real, but check whether the features you need sit in the enterprise code.
• Logto is licensed under MPL 2.0 (the Logto repository), a file-level copyleft license that lets you build closed products on top of it as long as you share changes to Logto’s own files. The same repository presents Logto Cloud as the fully managed way to run it.
• FusionAuth is not open source. Its license is a proprietary customer license agreement, under which the company “retains all ownership and proprietary rights”, although it offers a free version of the software to download. That can be a perfectly good product, but it is a different exit position: you can self-host the free version, not change or redistribute it.

A related detail catches teams out with Keycloak providers too. Keycloak itself stays Apache 2.0, but extensions a provider ships around it can carry their own licenses. Phase Two, for example, changed the license of its core extensions from AGPL 3.0 to the Elastic License 2.0, which is source-available rather than open source. If your realms come to depend on a provider’s extensions, read their licenses as carefully as the server’s.

How do the managed open source options compare?

The table puts the license and the managed offering side by side. We have left prices out on purpose, because vendors change them often; the pricing model column tells you what the bill grows with, which matters more over a few years than the starting figure.

Two patterns stand out. When the company that writes the software also runs the managed service (ZITADEL, Ory, Logto), you get one vendor for both, and the hosted product usually tracks the project closely; Ory, for example, says its hosted APIs are compatible with the open source servers (the Kratos repository). When the software is governed by a foundation and several companies host it (Keycloak), you can change provider without changing software, which is the strongest exit position in the table. Keycloak lists OpenID Connect, OAuth 2.0 and SAML 2.0 among its standard protocols (keycloak.org), which matters if you broker enterprise customers’ SAML identity providers.

How do you leave a managed identity provider?

An exit plan for identity is mostly about one question: can you move your users with their password hashes, so nobody has to reset a password on the day you switch. Configuration such as clients, roles and flows is tedious to rebuild but can be rebuilt. Password hashes cannot be recreated, because only your users know the passwords behind them. Our guide to planning an identity provider exit covers the full checklist.

Ask each provider for three things before you sign:

• An export you can run yourself, without opening a support ticket, that includes users and their credential hashes.
• A standard format that the open source version of the same software imports. For Keycloak, that is the realm export that kc.sh export writes to a file or directory, which kc.sh import can import back into a server (Keycloak’s import and export guide).
• Standard protocols at the edge. If your applications speak OpenID Connect to the IdP, moving mostly means changing the issuer URL and client credentials. If you provision users from an HR system or a customer’s directory, ask whether the service supports SCIM 2.0, the IETF protocol for provisioning and managing identity data, so provisioning moves too.

On Skycloak, the exit path is a realm export. It copies one realm with its configuration, clients, identity providers, flows and every user with their credentials, including password hashes and OTP secrets, in the same shape as Keycloak’s own kc.sh export, wrapped in an AES-256-CBC encrypted envelope that only the password you set at export time opens (realm export and import). You decrypt it with that password and import it into any Keycloak at the same version or newer. Realm export is on the Launch plan and above, and the same page explains how a plain Keycloak realm file comes in the other way.

You export the realm, with its users and password hashes, as an encrypted file, decrypt it into a standard Keycloak realm file, and import it with kc.sh import into a Keycloak you run at the same version or newer, where users sign in with the passwords they already have.

Per-user or infrastructure pricing: which grows better?

Managed identity is priced in two broad ways. Per-user models charge for active users, counted per month, per day or by tokens issued, so the bill follows your sign-ups. Infrastructure models charge for the servers or clusters you run, so the bill follows your load and stays flat while your user count grows. Neither is wrong, but they fail in different ways, and we compared the risks in identity provider pricing risk.

Per-user pricing is usually cheaper while you are small, and it can become the fastest-growing line in your budget when a consumer product takes off or a B2B customer adds thousands of seats. Infrastructure pricing costs more on day one, but a free tier or a marketing campaign that brings in many occasional users does not move it. Note that a sum of daily active users counts a user once for every day they sign in or refresh a token, as ZITADEL’s help page on DAU spells out, so an app people open every day costs more than its monthly user count suggests.

Skycloak uses the infrastructure model: every plan includes unlimited users, and you pay per cluster, from $29 a month on the Developer plan (pricing). Keycloak’s own sizing guidance supports this way of thinking, because it sizes CPU by request rate, allocating 1 vCPU for each 15 password-based logins per second as a starting point to validate with load tests, not by how many users are registered (Keycloak sizing concepts).

What limits should you check on extensions, themes and data residency?

The reason many teams pick Keycloak or another open source IdP is that they can change it: a custom authenticator, a user storage provider for a legacy database, a branded login theme. A managed service can quietly take that away, so check what you are allowed to upload and who maintains it across upgrades.

• Extensions: whether you can deploy your own code, and what happens to it on upgrades. On Skycloak, the Bring Your Own Extension add-on lets you upload your own Keycloak SPIs (the Java plugin interfaces Keycloak uses for authenticators, user storage and mappers), themes or authenticators as JAR files, and we handle deployment and updates (pricing).
• Themes: whether you can upload a full theme or only change colors and a logo. On Skycloak, uploading and downloading custom themes comes with the Business plan (pricing).
• Data residency: which regions you can pick, what runs there, and what does not. On Skycloak you choose US East, US West, the EU, Canada or Australia, and your Keycloak instance and its database run there, with database backups kept in that region’s country, while our control plane and email delivery run in the US (security). A provider that tells you what stays outside the region is easier to assess than one that only lists regions.

Where does Skycloak fit?

Skycloak runs upstream Keycloak on clusters dedicated to each paying customer, in the region you choose. Here is what our public pages commit to, so you can line it up against the four jobs above:

• Upgrades and patches: automatic Keycloak updates, with CVEs patched within 24 hours of release (managed Keycloak).
• Backups: daily automatic backups on Business (kept 14 days) and Enterprise (kept 30 days), which you can download as a PostgreSQL archive and restore into your own database (backups). Launch and above can also run a one-off database export.
• SLA and on-call: Developer and Launch are best effort with no contractual SLA; Business has a 99.9% monthly uptime SLA on its included Medium cluster, and Enterprise goes up to 99.99%, both with service credits; urgent requests get a 1 hour response on Business and Enterprise, and Enterprise support is 24/7 (SLA).
• Exit: realm export with password hashes in Keycloak’s own format, as described above.

If you already run Keycloak yourself and are deciding whether to hand it off, our analysis of whether self-hosting Keycloak is worth it puts numbers on the operational side. If you are leaving a proprietary service, our list of open source and managed Auth0 alternatives covers the wider field, and the decision memo template for replacing an identity provider helps you write the choice down for the rest of your team.

Frequently asked questions

What is a fully managed open source identity provider?

It is an identity provider whose software is published under an open source license, such as Keycloak under Apache 2.0, and that a vendor runs for you as a hosted service. The vendor performs upgrades, security patches, backups and incident response, and you keep the right to run the same software yourself, because the license guarantees it.

Is Keycloak available as a fully managed service?

Yes. Several independent companies run Keycloak for you, including Skycloak, Cloud-IAM and Phase Two. Because Keycloak is a CNCF project and not owned by any of them, you can move between these providers, or back to your own servers, using Keycloak’s standard realm export.

Is FusionAuth open source?

No. FusionAuth is distributed under a proprietary customer license agreement. It offers a free version you can download and self-host, but the license does not give you the rights to modify and redistribute the code that the Open Source Definition requires.

Is ZITADEL still open source after its license change?

Yes. Starting with version 3, ZITADEL is moving to AGPL 3.0, which is an open source license (ZITADEL licensing FAQ). AGPL asks you to share your changes if you modify ZITADEL and offer it over a network, so review it with your legal team if you plan to change the code.

Can I move users to another provider without forcing password resets?

You can when the provider exports password hashes and the target system supports the same hashing algorithm. Between Keycloak installations this is straightforward, because a realm export carries the hashes and the target imports them. Ask any provider to show you that export before you sign, not when you want to leave.

Should I choose per-user or infrastructure pricing?

Choose per-user pricing when you are small and your user count is predictable, and infrastructure pricing when you expect many users, many occasional users, or growth you cannot forecast. Model both against your two-year user projection, and remember that daily active user counts add up every day a user signs in.

What to do next

Write down which of the four jobs (upgrades, patches, backups, on-call) you want off your team, check each candidate’s license against the Open Source Definition, and ask every provider to demonstrate a full export with password hashes before you commit. With those three answers, the comparison usually narrows to one or two options.

If Keycloak is on your list, try Skycloak: import a realm export from your current Keycloak into a managed cluster and test your own login flows against it.