Who this comparison is for
AccessGuard highlights
- Cron jobs for prune/backup/event trimming included
- Profiles module (contacts, payments, media, consents, risk)
Keycloak highlights
- Highly extensible OSS with federations/providers
- Large community & plugins
Capability matrix
| Capability | AccessGuard | Keycloak | Notes |
|---|---|---|---|
| SSO (SAML/OIDC) | Full | Full | — |
| Hosted login multi-site | native (HMAC bridge) | partial (custom realm UI/CORS) | — |
| RBAC & route guard mapping | native (RouteGuard) | partial (roles/clients DIY) | — |
| MFA enforcement & staged rollout | Full | Full | Policies differ |
| Profiles (consent/KYC/risk/exports) | Native | none (DIY models/extensions) | — |
| Prometheus metrics | Native | partial (via operator/plugins) | — |
| Automated backups & pruning | native (cron) | none (ops runbooks) | — |
| Total time to first environment | hours | days | Assumes infra readiness |
- Operational posture differs: AccessGuard ships with maintenance jobs and metrics; Keycloak requires cluster/DB operations knowledge.
Total cost of ownership
Keycloak lowers license costs but shifts effort to operations and customization. AccessGuard reduces day-2 toil with built-ins (metrics, backups, profiles), often lowering overall TCO for small/medium platform teams.
Assumptions
- One SRE and one app engineer
- Audit/consent exports needed quarterly
Migration plan
From Keycloak · Realm export → issuer trust → progressive client migration
-
1
Export realms/clients; map roles to AccessGuard capabilities
-
2
Add AccessGuard as trusted issuer; dual-stack clients
-
3
Rotate secrets/tokens; enable MFA + consent prompts
Security
- Key management with rotation, RBAC, audit logs
- Event stream for SIEM/automation
Evidence & sources
| Claim | Value | Source |
|---|---|---|
| Backups & pruning | Cron: token prune hourly; backups 6-hourly | product_docs |
About AccessGuard
AccessGuard secures apps and external sites with hosted authentication and short-lived JWTs. Enable MFA, define RBAC permissions, and connect enterprise identity via SAML or OIDC. A lightweight HMAC bridge lets you embed login, registration, and token refresh flows on any domain without CORS pain.
Admins manage users, sessions, connections, and policies from one console. Profiles consolidate verified emails/phones, consents, KYC docs, and risk flags. Events and metrics provide visibility for security and ops.
Designed for velocity and safety: opinionated defaults, least-privilege keys, Prometheus counters, and exportable audit logs.