Auth0 Exit • Open-Source SSO
Managed Keycloak
We design, run and secure Keycloak-based single sign-on for you: OIDC, SAML, passwordless — in our Frankfurt data center. The sovereign alternative to Auth0 and Okta, without per-user pricing or a US dependency.
Initial situation
Auth0 and Okta own your identity layer — and price it per user
Auth0's pricing scales with monthly active users, so your identity bill grows with your success — and the data behind your logins sits in a US-controlled platform you can't fully audit or take with you. Keycloak does the same job — OIDC, SAML, MFA, passwordless — but it's open source, and you own it.
- Open source — no per-MAU fees, no seat tax
- The same standards you already use (OIDC, SAML 2.0)
- Your user and identity data stays in Germany
- NIS2-ready: MFA, passwordless, audit-friendly access
The offer
What "Managed Keycloak"
means at Hostzero
We run the cluster 24/7
Security patches applied immediately
99.9% availability SLA
Your identity data stays in Germany
No vendor lock-in — export anytim
Built for real-world single sign-on
Custom SSO Concepts
Tailored SSO strategies aligned with your business — drawn from years of running Keycloak in production, not a template.
Directory Integration
Seamless integration with Active Directory, LDAP and cloud directories (Entra ID / Azure AD) — no user migration required.
Passwordless Auth
FIDO2 and WebAuthn for stronger security and a smoother login than passwords or SMS codes.
Open Source
Automated with our open-source Keycloak Operator
Hostzero develops and maintains an open-source Keycloak Operator for Kubernetes that significantly simplifies running Keycloak in production.
The operator enables, among other things:
- Declarative deployment and configuration of Keycloak
- Reproducible setups using GitOps workflows
- Simplified updates and lifecycle management
- Clean integration into existing Kubernetes platforms
apiVersion: keycloak.hostzero.com/v1beta1
kind: KeycloakRealm
metadata:
name: production
spec:
realm: enterprise
ssoEnabled: true
mfaPolicy: required
identityProviders:
- type: azure-ad
alias: corporate
- type: oidc
alias: externalTransparent pricing
Packages & Prices
Two ways to work with us: a one-time SSO implementation, or fully managed operations. No per-user fees.
SSO Implementation
We design, integrate and migrate your SSO off Auth0/Okta
Managed Keycloak
We run it 24/7 — production-grade, fully managed
NIS2 / Audit Readiness Pack
For regulated and critical-infrastructure teams: MFA & SSO hardening, passwordless rollout, access documentation and security reviews.
Migration
From Auth0 to Keycloak — without locking users out
Audit
Map your apps, identity providers, user directories and login flows
Parallel setup
Keycloak runs alongside Auth0; we wire up OIDC/SAML and connect your directories
Cutover
Apps switch to Keycloak; Auth0 stays as a fallback during the transition
Operation
We run it 24/7 — patches, MFA policy, SLA; you drop the per-user bill
Why teams choose Hostzero for SSO
As a small, dedicated team of open-source experts, we offer personalized service and deep expertise in Keycloak and SSO.
Deep Expertise
Over five years running our own Keycloak instances in production — we operate it, not just install it.
Approachable Professionals
Work directly with the engineers who run your stack. No middlemen, no ticket queue.
Customized Solutions
Tailored to your specific requirements — no one-size-fits-all SSO.
Connect Everything
Connect everything — via SAML and OIDC
With Keycloak and our SAML/OIDC expertise, we connect virtually any platform — Kubernetes, cloud services, enterprise apps — to one central identity. Centralized access control improves security and simplifies user management, on-premise or in the cloud
"We connected all the services our team of software developers and designers uses, including complex tools like Kubernetes and third-party software where Keycloak now serves as the IdP. This has significantly reduced the time spent on managing user access and increased our overall security."
Ljubomir Radoš, Kickstage, Kickstage
FAQ
Frequently Asked Questions
Start now
Ready to own
your identity layer?
Talk to an engineer — 30 minutes, no sales pitch. We'll look at your Auth0/Okta setup and tell you honestly what a Keycloak migration would take.