Keycloak

Keycloak adds authentication to applications and secures services with minimal effort, so a team never has to store users or write a login flow of its own. Credentials, sessions and account recovery move out of the application entirely, which is where most of the security bugs in homegrown auth tend to live.

Beyond sign-in, the server covers user federation, strong authentication, user management and fine-grained authorization. The project publishes an operator package for Kubernetes and tracks open source best practice and security scorecard ratings in public, both of which matter for something sitting on the critical path of every login.

Running and working on the server follows a short set of paths.

• Distribution start: download a release, unzip it and run the kc script in development mode.
• Container start: the published image from the project registry starts the same way with one command.
• Building from source: a separate guide covers compiling the server for contributors.
• Testing: guides exist both for running the test suite and for writing new tests.
• Related projects: client libraries, quickstarts and a Node.js adapter live in their own repositories.

Help arrives through documentation, a mailing list for general questions and chat channels split between user help and design discussion, while security vulnerabilities follow a documented disclosure process instead of the public issue tracker. Contributors are asked to read the guide and the code of conduct first, and joining a maintainer area is offered as a way to shape where the project goes.