Casdoor vs Keycloak

An open-source Keycloak alternative, with a managed cloud

Keycloak and Casdoor are both open source under Apache-2.0. The difference is in what comes with them: Casdoor speaks more protocols, ships Casbin authorization, and has a managed cloud from the team that builds it.

See Casdoor Cloud pricing Self-host for free

Casdoor and Keycloak at a glance

	Casdoor	Keycloak
Source code	Open source (Apache-2.0)	Open source (Apache-2.0), a CNCF incubating project
Managed service	Casdoor Cloud, from $25/month, run by the Casdoor team	None from the project; Red Hat build of Keycloak is supported by Red Hat but run by you
Commercial support	From the Casdoor team, included with Cloud plans or on request	Through Red Hat subscriptions (such as Runtimes or OpenShift) or third parties
Protocols	OAuth 2.0, OIDC, SAML, CAS, LDAP, RADIUS and SCIM	OpenID Connect, OAuth 2.0 and SAML; connects to existing LDAP and Active Directory servers

Information about Keycloak is from its public website as of October 2026 (keycloak.org, Red Hat build of Keycloak subscriptions) and may have changed. Keycloak is a trademark of its owner.

Why teams choose Casdoor

Don't want to run it?

Casdoor Cloud gives you a dedicated instance and database from $25/month, upgraded by us.

More protocols

Casdoor adds CAS, and can itself serve LDAP and RADIUS for apps and devices that only speak those.

Casbin built in

Model ACL, RBAC or ABAC permissions with Casbin, the authorization library Casdoor is built around.

Ready for AI agents

Casdoor can be the OAuth authorization server for your MCP servers, with tokens scoped to the tools a user allowed.

When Keycloak may fit better

You already run Red Hat OpenShift or Runtimes and want Red Hat to support your identity server.
Your team already knows Keycloak well and has no need for a managed service.

Moving from Keycloak to Casdoor

Casdoor's syncers import users and groups from Keycloak, and apps that use OpenID Connect or SAML only need a new issuer URL and client credentials. Run both side by side and move apps over one at a time; we can help plan larger migrations.

Plan a migration with us

FAQ

Frequently asked questions

Is Casdoor open source like Keycloak?

Yes. Both are licensed under Apache-2.0. Casdoor Cloud runs the same open-source Casdoor, so you can move between Cloud and self-hosting at any time.

Can Casdoor import users from Keycloak?

Yes. Casdoor has a syncer for Keycloak, as well as for Active Directory, LDAP, Entra ID, Google Workspace, Okta, AWS IAM and SCIM directories.

Compare

How Casdoor compares

Casdoor vs Auth0 Casdoor vs Okta

Ready to secure your next big move?

Put login, single sign-on, MFA, permissions and AI agent access behind one open-source platform, hosted by us or run by you.