Managed Keycloak Hosting
for complex IAM requirements.
Your own Keycloak instance for SAML, identity brokering, AD federation and separate realms. authhost operates the Java stack on Quarkus, including PostgreSQL and the Infinispan cache.
- SAML 2.0 as identity provider and service provider
- LDAP and AD federation with write-back
- Dedicated instance, not a shared tenant
- contract term according to proposal
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
What Keycloak is built for
Keycloak combines federation, tenant separation and fine-grained authorization for IAM environments with demanding requirements.
- 01
Keycloak is Apache-2.0 licensed, is a CNCF Incubating project and is backed by Red Hat. The application runs with Java on Quarkus. Its broad scope ranges from SAML 2.0 as an identity provider and service provider to identity brokering, directory federation and authorization services.
- 02
It fits tenders, public authorities and corporate subsidiaries, as well as projects with SAML, eIDAS, AD federation or multi-tenant requirements. Realms serve as tenant boundaries, while client policies and step-up authentication cover rules for individual use cases.
- 03
authhost operates Authentik, Keycloak and Zitadel. If requirements change, switching the identity provider therefore does not require switching the operations provider. The choice can follow the functional need, not an existing provider relationship.
What your Keycloak instance can do
The functions are particularly suited to federated directories, SAML environments and separated tenants.
SAML 2.0 in both roles
Keycloak works as both an identity provider and a service provider. This matters in enterprise and public-sector environments shaped by SAML.
Identity brokering
External identity sources can be connected through Keycloak in a central sign-in structure.
LDAP and AD federation
Existing LDAP and Active Directory sources can be connected, including write-back.
User Storage SPI
The User Storage SPI lets Keycloak include further user stores in identity management.
Authorization Services
Fine-Grained Authorization Services represent differentiated authorization requirements within the platform.
Realms as tenant boundaries
Separate realms structure tenants within a Keycloak instance.
Client policies
Client policies collect requirements for connected clients and their configuration.
Step-up authentication
Keycloak can require additional authentication for selected situations.
Transparent pricing. No surprises.
Instance and service level under WZ-IT terms. Germany is the standard location; other locations on request.
Select Region
Included in every tier
Features
- SSO via OIDC, OAuth2 and SAML 2.0
- SAML 2.0 as identity provider and service provider
- Identity brokering to external providers
- LDAP and AD federation including write-back
- User storage SPI for your own user sources
- Realms with no count limit
- Fine-grained authorization services
- Client policies and step-up authentication
- MFA: TOTP, WebAuthn and passkeys
- SCIM API for provisioning (preview, behind a feature flag)
The feature scope follows the respective open source project and can change with new releases. The official documentation is authoritative; all details without warranty: keycloak.org/documentation
Included in the hosting
- Dedicated instance, no shared hosting
- Users with no count limit
- Subdomain included (*.authhost.de)
- Your own domain possible
- PostgreSQL included
Operations
Operations, updates and backups within the agreed scope · 24/7 automated monitoring · Standard hosted-workload availability: 99.9% per month · Germany as the standard location · Data processing agreement · Setup and contract term defined in the proposal
Choose your support
Essential, Business and Priority apply during defined service windows. Production and Critical add round-the-clock response to P1 incidents. Business and higher levels include a monthly operations allowance for planned technical work.
Choose your instance size
The size determines compute and memory, not the feature scope. When a size stops being enough, we move you up during operation.
M
Instance sizeexcl. VAT · incl. support Essential
- 4 vCPU
- 8 GB RAM
- 160 GB NVMe
- 5 TB Traffic
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
L
Instance sizeexcl. VAT · incl. support Essential
- 8 vCPU
- 16 GB RAM
- 240 GB NVMe
- 5 TB Traffic
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
Keycloak runs on the JVM and needs more memory than a Python or Go stack. The smallest size is therefore not offered for Keycloak.
Compute and service level are selected independently. Actual resource requirements are assessed before quoting.
Hosting and additional project work are agreed separately. WZ-IT service levels and published support terms apply. Explore expert support
All prices are net, plus statutory VAT. This offer is directed exclusively at businesses within the meaning of § 14 German Civil Code, not at consumers.
Business, Priority, Production and Critical include the first covered workload in a customer environment. Further covered workloads cost 29.90 €, 49.90 €, 69.90 € and 99.90 € per month respectively.
The flexible operations allowance applies to planned work during regular service hours and expires at month end. Operations, monitoring, backups, maintenance and updates within the agreed scope do not reduce it. Additional and incident work costs €120 net per hour in 6-minute increments during regular service hours and €240 net per started hour outside them.
Production and Critical require technical acceptance. Critical is capacity-limited. Response targets apply to P1 incidents through the agreed ticket system, not to every request or a guaranteed resolution time.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
All WZ-IT service levels and incident rulesWhat matters in Keycloak operations
The complexity lies mainly in caching, high availability, JVM sizing and controlled upgrades.
PostgreSQL and Infinispan
Keycloak requires PostgreSQL plus an Infinispan cache. Since version 26, persistent sessions are stored in the database.
Complex high availability
An HA setup requires suitable cluster discovery and cache topology. Both layers need to be sized together with the instance.
Upgrades with known break points
The move from version 25 to 26 included a marshalling break that caused session loss. The earlier change from WildFly to Quarkus took place with version 17 in 2022.
Compatibility policy since 2024
Since October 2024, breaking changes in minor releases are opt-in through feature and API versioning. Removals only arrive with a major release. Much of the older criticism of the upgrade cycle comes from the period before this policy.
JVM sizing
As a JVM application, Keycloak needs considerably more RAM than a Python or Go stack. The guideline is at least 1 GB plus JVM tuning.
Backups, monitoring and commitment
Essential: Initial technical response to critical incidents (P1) by the end of the next business day, Mon-Fri, 08:00-17:00 CET/CEST · Business: Initial technical response to critical incidents (P1) within 4 service hours, Mon-Fri, 08:00-18:00 CET/CEST · Priority: Initial technical response to critical incidents (P1) within 1 service hour, Mon-Fri, 08:00-18:00 CET/CEST · Production: Initial technical response to critical incidents (P1) within 60 minutes, 24/7, P1 around the clock · Critical: Initial technical response to critical incidents (P1) within 30 minutes, 24/7, including callback, P1 around the clock. Production and Critical require technical acceptance. Critical is capacity-limited. Response targets apply to P1 incidents through the agreed ticket system, not to every request or a guaranteed resolution time. The flexible operations allowance applies to planned work during regular service hours and expires at month end. Operations, monitoring, backups, maintenance and updates within the agreed scope do not reduce it. Additional and incident work costs €120 net per hour in 6-minute increments during regular service hours and €240 net per started hour outside them.
Data location and processing
Germany is the standard location. Other locations and their operating conditions are assessed on request before quoting. Location, backup destinations and responsibilities are documented.
You can choose Germany, the Netherlands, the USA, Canada, Singapore, Japan, Australia or India. Every customer instance is dedicated and is not operated as a shared tenant.
The data processing agreement under Article 28 GDPR is included in every plan. Automatic backups remain in the same region as the Keycloak instance.
How you get to your Keycloak instance
From signup to the first connected directory it takes four steps.
- 1
Start the instance
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
- 2
Create realms
Separate tenants the way your organisation needs: per subsidiary, per customer or per environment. The number is not capped.
- 3
Connect directories
Set up LDAP or AD federation, with write-back where needed, or connect an existing provider through identity brokering.
- 4
Hand over operations
After the trial the instance converts automatically to the selected plan. Updates, backups and monitoring are ours from then on.
Hosting by WZ-IT
One team for your hosting and everything running on it.
authhost is a hosting service by WZ-IT. We connect infrastructure, software and ongoing operations. Timo and Robin discuss your requirements and agree who is responsible for what.
- Directly with Timo and Robin - no sales handoff
- Operations and support under the agreed WZ-IT service levels
- Managed IAM hosting; IAM migration and application integrations are not included
A WZ-IT team consultation to get acquainted and discuss your requirements.
More about WZ-IT
Read on
Managed Authentik hosting
For conventional mid-sized companies that need central sign-in and a managed dedicated instance.
Managed Zitadel hosting
For software vendors and SaaS providers using organizations, an audit log and an API-first approach.
Which identity provider fits?
Authentik, Authelia and Keycloak compared directly with a decision matrix.
Frequently asked questions about managed Keycloak hosting
What does managed Keycloak hosting cost?+
S: from 129.90 € · M: from 159.80 € · L: from 219.80 € net per month with Essential. Higher service levels follow WZ-IT terms and include the first registered workload. Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
Who is Keycloak suitable for?+
Keycloak fits tenders, public authorities, corporate subsidiaries and projects with SAML, eIDAS, AD federation or multi-tenant requirements. Realms, identity brokering and federation of existing directories are among its defining functions.
Why is Keycloak demanding to operate?+
The stack includes PostgreSQL and Infinispan. High availability requires planning cluster discovery and cache topology. There is also the JVM: as a guideline, Keycloak requires at least 1 GB of RAM plus JVM tuning.
How risky are Keycloak upgrades?+
Upgrades remain an important operational issue. The move from version 25 to 26 included a marshalling break with session loss. Since October 2024, a compatibility policy limits breaking changes in minor releases to opt-in changes through feature and API versioning, with removals only in major releases.
Which federation functions does Keycloak provide?+
Keycloak supports SAML 2.0 as an identity provider and service provider, identity brokering, and LDAP and AD federation including write-back. The User Storage SPI can include further user stores.
Where are data and backups stored?+
The default region is Germany, in data centers with ISO 27001 and BSI C5. Seven further regions are available. Automatic backups stay in the same region as the instance.
What availability and support response apply?+
Essential: Initial technical response to critical incidents (P1) by the end of the next business day, Mon-Fri, 08:00-17:00 CET/CEST · Business: Initial technical response to critical incidents (P1) within 4 service hours, Mon-Fri, 08:00-18:00 CET/CEST · Priority: Initial technical response to critical incidents (P1) within 1 service hour, Mon-Fri, 08:00-18:00 CET/CEST · Production: Initial technical response to critical incidents (P1) within 60 minutes, 24/7, P1 around the clock · Critical: Initial technical response to critical incidents (P1) within 30 minutes, 24/7, including callback, P1 around the clock. Production and Critical require technical acceptance. Critical is capacity-limited. Response targets apply to P1 incidents through the agreed ticket system, not to every request or a guaranteed resolution time. The flexible operations allowance applies to planned work during regular service hours and expires at month end. Operations, monitoring, backups, maintenance and updates within the agreed scope do not reduce it. Additional and incident work costs €120 net per hour in 6-minute increments during regular service hours and €240 net per started hour outside them.
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.+
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
Have your Keycloak instance sized
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.