Timonier vs Keycloak

You're already running Keycloak, and it works. This page isn't going to pretend otherwise: on self-serve operations, Keycloak is ahead of us today. We'd rather say that plainly than publish a comparison you can't trust to tell you when the status quo is the right call.

Choose Keycloak if licensing and control matter most

Keycloak is distributed under the Apache License 2.0 and governed by the Cloud Native Computing Foundation as an Incubating project since April 2023, not by a single company. That means you can fork it, redeploy it, and set your own upgrade cadence without any vendor's approval. Commercial distributions of Keycloak do exist. Red Hat build of Keycloak is one, a supported product built on the open-source project, so "no vendor relationship" means none is required to run it, not that none is on offer if you want one.

That's a real strength of foundation governance: it doesn't depend on any single vendor's roadmap continuing. We won't call ourselves "mature" to compete with it. A licence, a foundation, and incubating status since 2023 are facts about governance, not about how battle-tested a codebase is, and we're not going to borrow the word to imply more than they support.

What Keycloak's self-serve path costs you operationally

Keycloak's own docs are direct about what that leaves to you: "the Keycloak Operator does not manage the database and you need to provision it yourself", and "Keycloak mandates the configuration of the hostname option and does not dynamically resolve URLs". Provisioning the database and configuring the hostname are on you, not the Operator.

Our split-plane design is intended so that a self-hosted deployment runs only the identity-holding part of the system, not a full application stack. But that's intent, not something you can go do today: our self-hosting path is not yet publicly documented, while Keycloak's is self-serve right now, with container images, an Operator, and public docs all available to you this afternoon. Weigh architectural intent against a path you can actually walk today, and today Keycloak wins that comparison.

One more concession while we're being honest: Keycloak implements both OIDC and SAML 2.0. We implement OIDC only. If SAML is a requirement anywhere in your organization, that alone may settle this comparison before licensing or operations enter into it.