Skip to content
Halo
GitHubGet started

Compare

Halo vs Keycloak

How Halo compares with Keycloak: the same job of hosting your own identity provider, with a different licence-to-operations trade and a different product around access reviews and SSH.
Ready to switch to HaloAll comparisons
vs

Halo and Keycloak

Choose Halo when

  • You want access requests, access reviews, and joiner, mover and leaver rules in the same product as sign-in.
  • You want an SSH certificate authority next to the directory, rather than a second system.
  • You would rather run Postgres and two containers than a Java distribution.

Choose Keycloak when

  • You need LDAP and Active Directory federation that has been in production for years.
  • You already operate Keycloak, or you need its realm model and extension SPI.
  • You want a project with numbered releases and a long support history. Halo has not published a release yet.

Keycloak

Halo and Keycloak, row by row.

Feature comparison
CapabilityHaloKeycloak
How you run it
LicenceApache-2.0Apache-2.0
Self-hostedYou run itYou run it
Hosted serviceNoneThrough vendors
Published releaseNot yet
Sign-in
Passkeys and security keys
OpenID Connect
SAML 2.0
Workforce access
Conditional accessPoliciesAuth policies
Requests, reviews, lifecycleIncludedNot the product
SSH certificatesBuilt in
SCIMIn and outPreview
LDAPNot a directory serverFederation

Drawn from public documentation. Halo has not published a release yet. Corrections belong in the issue tracker.

The other comparisons