The license is only one line item
Open-source identity can be a strong choice when a team needs control, extensibility, or deployment inside its own environment. A zero-dollar license does not make the service free to operate.
A production identity service also needs a database, TLS, secrets management, monitoring, backups, tested recovery, upgrade planning, directory synchronization, security review, and an incident path. Those responsibilities remain with the operator regardless of which project supplies the software.
Build a workload estimate from your environment
Avoid publishing one universal monthly-hours estimate. The effort changes with user count, application count, availability targets, tenant boundaries, customization, and the maturity of the operating team. Estimate each recurring activity with a named owner, expected frequency, and evidence of completion.
| Activity | Questions to estimate | Evidence to retain |
|---|---|---|
| Security updates | Who reviews advisories, tests patches, approves rollout, and handles emergency fixes? | Advisory review, test result, change approval, deployed version |
| Platform upgrades | How many custom flows, extensions, themes, providers, and clients require regression testing? | Compatibility notes, test plan, rollback decision, outcome |
| Directory synchronization | How quickly must joins, changes, and terminations propagate, and who investigates failures? | Sync health, reconciliation result, failed objects, remediation |
| Backup and recovery | What are the recovery-time and recovery-point objectives, and how often is restoration tested? | Backup result, restore test, measured recovery time, unresolved gaps |
| Availability and incidents | Who is on call when SSO blocks access, and what break-glass path remains available? | Alert, incident timeline, affected applications, corrective actions |
| Configuration changes | How are new applications, claims, roles, policies, and secrets reviewed and promoted? | Source revision, approval, deployment record, validation |
Costs that teams commonly omit
- Failure-domain design. Account for database availability, ingress, DNS, certificates, email delivery, secrets, and the dependencies needed for login and recovery.
- Customization ownership. Every custom authenticator, extension, theme, expression, or integration adds an upgrade and security-review obligation.
- Administrative access. Protect the management plane with phishing-resistant authentication, restricted networks, separation of duties, and audited emergency access.
- Tenant isolation. Document the actual isolation boundary and test how administrative mistakes, shared policies, and automation behave across it.
- People risk. Runbooks, peer review, and cross-training matter when one engineer understands the deployment more deeply than the rest of the team.
Compare options on the same basis
- Define required protocols, application integrations, user lifecycle, passkeys, device context, audit retention, data residency, availability, recovery, and support before choosing a product.
- Price infrastructure, engineering time, support contracts, and expected incident work for self-hosting. Price subscription, implementation, integration, and any retained operational work for a managed service.
- Use a representative proof of concept that includes an upgrade, a failed dependency, a directory-sync exception, a lost authenticator, and a backup restoration—not only a successful login.
- Record which responsibilities transfer to a vendor and which still belong to your team. Managed software changes the responsibility model; it does not remove identity governance.
Related resources
- Choose a deployment pattern with Self-hosted identity on Docker Compose and Kubernetes.
- Compare declarative configuration and isolation in Keycloak vs. Authentik for GitOps and multi-tenancy.
- Explore Gideon Identity as a managed comparison point.
How to use this resource
Turn each activity into a row in your evaluation worksheet. Assign an owner, frequency, service objective, test method, and estimated effort based on your own environment. Compare vendors only after both self-hosted and managed options include the same security and availability requirements.