Start with the identity problem, not the orchestrator
Putting SSO in front of web applications requires an OIDC, OAuth 2.0, or SAML identity provider. Joining Windows devices to a domain and issuing Kerberos tickets requires directory and domain-controller capabilities. These are different workloads even when both are called self-hosted identity.
Keycloak and Authentik are application identity providers. Authelia is commonly used with a reverse proxy to protect web applications. Samba Active Directory Domain Controller and FreeIPA address directory, Kerberos, DNS, and host-integration needs. Select the category first, then choose Compose or Kubernetes.
Docker Compose options
| Option | Best fit | Operational boundary |
|---|---|---|
| Keycloak with PostgreSQL | Standards-based SSO, enterprise federation, realms, and extensibility | Operate the database, TLS, backups, upgrades, and any providers or extensions |
| Authentik with PostgreSQL | Visual authentication flows, proxy outposts, and Blueprint-driven configuration | Operate server and worker services, database, outposts, email, backups, and upgrades |
| Authelia with a reverse proxy | Adding an authentication gate to reverse-proxied services | It is not a drop-in replacement for every full identity-provider or directory requirement |
| FreeIPA or Samba AD DC | Host and directory identity rather than only web SSO | Stateful networking, DNS, Kerberos, storage, and recovery require specialized design |
Kubernetes options
- Keycloak. The official Operator manages Keycloak deployments, but the database remains an external prerequisite. The KeycloakRealmImport custom resource creates new realms; it does not continuously update or delete existing realms.
- Authentik. The official Helm chart packages the application for Kubernetes. Blueprints can define identity objects, while database durability, ingress, secrets, outposts, backup, and upgrade testing remain operator responsibilities.
- Directory services. Samba AD DC and FreeIPA are stateful, hostname- and network-sensitive services. A container image does not make DNS, Kerberos, persistent storage, replication, or disaster recovery stateless.
Production readiness checklist
- Use an external or highly available database design with explicit backup, restore, encryption, and credential-rotation procedures.
- Define stable hostnames, TLS issuance and renewal, trusted proxy ranges, ingress behavior, email dependencies, and outbound network requirements.
- Test login, logout, token refresh, user lifecycle, directory synchronization, passkey recovery, and administrative break-glass access during dependency failures.
- Pin versions, read release notes, test upgrades with production-like configuration, and keep a documented rollback or recovery path.
- Monitor user-facing authentication, administrative events, queues or workers, database health, certificates, sync jobs, and backup completion.
Primary references
- Keycloak documents its supported Kubernetes deployment path in Keycloak Operator installation.
- Keycloak documents database and hostname prerequisites in Basic Keycloak deployment.
- Authentik describes its supported small-scale installation in Docker Compose installation.
- FreeIPA describes the added complexity of containerized servers in FreeIPA server containers.
Related resources
- Model the operating commitment with Open-source identity and SSO: the real cost of self-hosting.
- Compare identity configuration approaches in Keycloak vs. Authentik for GitOps and multi-tenancy.