> Source: https://meetrix.io/store/keycloak/
> Markdown copy of that page. Cite the URL above, not this file.

[Store](https://meetrix.io/store/)  Keycloak

Open-source Auth0 alternative

# Self-hosted Keycloak on AWS

Add single sign-on, social login and user federation to your applications with Keycloak, running from a pre-configured AMI in your own AWS account. User data stays on your infrastructure, with no per-user pricing.

 [Launch on AWS](https://aws.amazon.com/marketplace/pp/prodview-6jwxrf4df22mo)

-   Ready in 5-10 minutes
-   OIDC, SAML and OAuth2
-   No per-user fees

![Keycloak identity and access management deployed on AWS by Meetrix](https://meetrix.io/assets/store/keycloak/keycloak.webp)

## What is Keycloak?

Keycloak is an Apache 2.0 identity and access management server. It provides single sign-on, social login, identity brokering and LDAP or Active Directory federation for your applications, with every feature available in the open-source project.

-   ### Single sign-on

    One login across your apps with OIDC, SAML and OAuth2.

-   ### MFA built in

    Multi-factor authentication without a paid tier.

-   ### Social login

    Let users sign in with external identity providers.

-   ### User federation

    Connect existing LDAP or Active Directory users.

-   ### Realms

    Separate users and apps into isolated realms.

-   ### Fine-grained authorisation

    Roles, groups and policies for access control.

## What's in the Meetrix Keycloak AMI

The AMI ships Keycloak with an admin account and SSL handled at launch.

-   Keycloak with the admin password you set at launch
-   Security group rules for SSH, HTTP and HTTPS
-   Automatic SSL when your domain is hosted on Route 53
-   A certificate script for issuing SSL manually otherwise
-   A CloudFormation template for your own AWS account
-   Email support from Meetrix at aws@meetrix.io

## How to set up a self-hosted Keycloak server

1.  ### Launch the stack

    Subscribe on AWS Marketplace and launch the CloudFormation stack with your domain, admin email and admin password.

2.  ### Point your domain at it

    After 5-10 minutes, create a DNS record with the PublicIp from the stack outputs.

3.  ### Sign in to the admin console

    Open the DashboardUrl and sign in as admin with the password you set.

4.  ### Create a realm and client

    Add a realm for your users and a client for each application that should use SSO.

## Deploy on AWS

### Keycloak on AWS

An AMI on AWS Marketplace, launched into your own AWS account with CloudFormation or from EC2.

Deploys with

CloudFormation or EC2

Recommended size

t3a.medium

Ready in

5-10 minutes

#### Setup guides

-   [**Developer guide** Launch, DNS, admin console, SSL](https://meetrix.io/blogs/keycloak-developer-guide/)
-   [**Jitsi Meet SSO with Keycloak** OIDC setup for Jitsi](https://meetrix.io/blogs/jitsi-keycloak-sso/)

 [Launch on AWS](https://aws.amazon.com/marketplace/pp/prodview-6jwxrf4df22mo)

## Keycloak server ports

The vendor-recommended security group opens these ports.

| Service | Ports | Protocol |
| --- | --- | --- |
| HTTP and HTTPS | 80, 443 | TCP |
| SSH (administration) | 22 | TCP |

## Keycloak vs Auth0

|  | Keycloak | Auth0 |
| --- | --- | --- |
| Licence | Apache 2.0, self-hosted | Proprietary SaaS |
| Pricing | Free, pay only for your server | Free to 25,000 MAU, then paid plans |
| MFA | Built in, free | Gated behind paid tiers |
| Data location | Your infrastructure | Okta's infrastructure |
| Maintenance | Yours | None, fully managed |

Weighing Authentik as well? [Read Authentik vs Keycloak →](https://meetrix.io/blogs/authentik-vs-keycloak/)

## Keycloak FAQ

What is Keycloak?

An open-source identity and access management server offering SSO, social login, identity brokering, LDAP and Active Directory integration, and user federation.

Is Keycloak free?

Yes. It is Apache 2.0 licensed with every feature in the open-source project. On AWS you pay for the instance and any Meetrix software fee shown on the listing.

How do I sign in the first time?

Open the DashboardUrl from the stack outputs and sign in with the username admin and the AdminPassword you set.

Is Keycloak a good Auth0 alternative?

It is the most established self-hosted one: standards-based, with MFA and SSO included. You run the server yourself instead of paying per monthly active user.

Can I use it for Jitsi Meet SSO?

Yes, through an OIDC adapter that turns a Keycloak login into the JWT Jitsi expects. Our Jitsi Keycloak SSO guide covers the setup.

Which instance size should I choose?

t3a.medium is the recommended starting point.

How is SSL set up?

Automatically when your domain is hosted on Route 53. Otherwise SSH in and run sudo /root/certificate\_generate\_standalone.sh.

How do I upgrade?

Back up your realm data and configuration, remove the old stack and launch the updated AMI from AWS Marketplace.

## Keycloak guides and articles

### [Keycloak vs Auth0: Open Source vs SaaS Identity](https://meetrix.io/blogs/keycloak-vs-auth0/)

Pricing, features and data control, compared.

### [Authentik vs Keycloak: Which Open Source Identity Provider?](https://meetrix.io/blogs/authentik-vs-keycloak/)

Features, protocols and licensing for self-hosted IdPs.

### [Jitsi Meet SSO with Keycloak: OIDC Setup Guide](https://meetrix.io/blogs/jitsi-keycloak-sso/)

Bridge Keycloak login to the JWT Prosody expects.

## Need a hand with Keycloak?

We build and run self-hosted identity infrastructure every day, from SSO integrations to user federation. Tell us what you need.

[Contact us](https://meetrix.io/contact-us/)