Okta → Keycloak

Okta sells identity in two product lines. Workforce Identity covers staff sign-in to company applications, and Customer Identity, which includes Auth0, covers sign-in for an organisation’s own customers. Keycloak is an open-source identity and access management server. Its website lists single sign-on, social login, identity brokering and LDAP or Active Directory federation, built on OpenID Connect, OAuth 2.0 and SAML 2.0, and describes it as a Cloud Native Computing Foundation incubation project.

What Okta costs

Okta’s Workforce Identity page lists three public prices per user per month: Starter at $6, Core Essentials at $14 and Essentials at $17. Professional and Enterprise are quoted on request. The footnotes say all suites are billed annually and that Workforce Identity needs a $1,500 annual contract minimum. Essentials adds adaptive MFA, Lifecycle Management and Access Governance to the Starter bundle. For customer-facing sign-in, the same page shows an Enterprise base platform at $3K per month billed annually, with the B2C and B2B suites priced on inquiry.

What Keycloak costs

The Keycloak repository is licensed under Apache-2.0, so there is no licence charge and no per-user meter. The cost moves elsewhere: servers, a database, upgrades, monitoring and the staff time to look after them. A vendor option is the Red Hat build of Keycloak. Red Hat’s subscription article says it is included with Red Hat Runtimes, Application Foundations and OpenShift Container Platform subscriptions, is not sold as a separate product, and is customer-installed software rather than a managed service. Red Hat’s lifecycle policy gives each major version from 26.x at least two years of full plus maintenance support, and three years from 27.x onward.

What the switch changes

With Okta, the vendor operates the directory, the login pages and the availability target. With Keycloak, a realm holds users, clients and authentication flows, and the team decides how it is deployed, backed up and patched. Each application that trusts Okta over SAML or OIDC has to be registered as a client in the new realm and pointed at the new endpoints. Keycloak can also act as a broker to an external SAML or OIDC identity provider, importing its settings from a metadata URL or file, and it creates a local database entry for each brokered user. That makes a staged move possible, with some people still authenticating against Okta while applications are cut over.

What migration involves

Passwords are the hard part. Okta’s Users API documentation says a password that exists is shown as an empty object rather than a value, and an Okta support article says a hash export is possible only in very limited cases, for active users moving from Okta to Auth0, through the account team and a support case. Okta’s own migration guide covers importing users into Okta, not leaving it. For Keycloak, plan on a password reset for most users or a login-time migration against a system you keep running. Keycloak’s server guides do not describe importing password hashes from another system, so test that on your version before promising it.

On the Keycloak side, the CLI export includes users, and the Admin Console partial import accepts those files with fail, skip or overwrite options for existing records. Admin Console exports mask passwords and are described as unsuitable for server-to-server transfers. Okta’s public documentation does not describe an export of MFA enrolments, so users should expect to enrol again; Keycloak’s guide describes an administrator action that emails a link to set up a one-time password device.

Migration checklist

• List every application using Okta and note whether it speaks SAML or OIDC.
• Export the user list and attributes through the Okta API, and decide how groups map to Keycloak roles.
• Ask your Okta account team whether a hash export applies to your case; otherwise schedule resets.
• Stand up Keycloak with a database, backups and a tested upgrade path before importing anyone.
• Register each application as a client and test sign-in on a staging realm.
• Pilot with a small group, then move applications in batches while keeping Okta active.

The trade is a subscription bill for operational responsibility, which suits teams with platform engineers.