Feature Comparison: dracory/auth vs Keycloak
Comparison of github.com/dracory/auth with Keycloak, the open-source identity and access management server (Red Hat / CNCF).
High-Level Differences
| Aspect | dracory/auth | Keycloak |
|---|
| Type | Go library embedded in your app | Standalone IAM server (Java) you deploy and operate |
| Language | Go only | Language-agnostic via OIDC/SAML protocols |
| Deployment | No extra infrastructure | JVM service + PostgreSQL/MySQL; clustering for HA |
| Data ownership | Your database, your schema | Keycloak-managed schema in its DB |
| UI | Built-in server-rendered HTML | Hosted login themes + Account Console |
| Protocols | Cookie/session + own endpoints | Full OIDC, OAuth 2.0, SAML 2.0 |
Feature Matrix
| Feature | dracory/auth | Keycloak |
|---|
| Email/password | ✅ | ✅ |
| Otp | ✅ Email codes + magic links | ✅ WebAuthn/magic link (config) |
| Social / identity brokering | ❌ | ✅ Brokering to Google, GitHub, AD, etc. |
| Enterprise SSO (SAML, OIDC, LDAP/Kerberos) | ❌ | ✅ User federation, mappers |
| MFA / WebAuthn | ❌ | ✅ OTP, WebAuthn, conditional flows |
| SSO across many apps | ❌ Per-app sessions | ✅ Realms + single sign-on |
| Fine-grained authorization | ❌ | ✅ Roles, groups, policies, UMA |
| Organizations / multi-tenancy | ❌ | ✅ Realms / Organizations (newer) |
| Impersonation | ✅ Built-in | ✅ Admin impersonation |
| Brute-force protection | ✅ Rate limiting + lockout | ✅ |
| Ready-to-use UI | ✅ Server-rendered | ✅ Themed hosted pages |
| Middleware | ✅ Web/API/optional | ✅ Adapters / OIDC middleware |
| Ops burden | ✅ None — it's a library | ❌ Significant (JVM, DB, upgrades, HA) |
| Resource footprint | ✅ Tiny | ❌ Heavy (Java + DB) |
| Audit / events | ✅ log/slog hooks | ✅ Event listeners, admin events |
| Multiple login methods simultaneously | ✅ Composable via NewMultiMethodAuth + types.Method (otp, magiclink, password, authknight, custom methods) | {mm} |
|---|
| Remember-me (extended sessions) | ✅ Built-in opt-in session extension | {rm} |
Legend: ✅ built-in · ⚠️ partial/conditional · ❌ not available
Branding & Layout Options
| Aspect | dracory/auth | Keycloak |
|---|
| Full layout control | ✅ FuncLayout wraps any page body in your own site shell (own <head>, nav, footer) | ✅ FreeMarker theme engine — override any page (.ftl) per realm |
| Theming / CSS | ✅ ThemeCSS (any hosted stylesheet / Bootlegance) + CustomCSS inline overrides | ✅ Custom themes: CSS, images, messages; per-realm assignment |
| Brand name / logo | ✅ BrandName, BrandTagline, BrandLogoURL rendered above the login card | ✅ Display name per realm + logo via custom theme |
| Email templates | ✅ Per-flow FuncEmailTemplate* callbacks — full control | ✅ Themed email templates (.ftl) |
When to Choose dracory/auth
- Single Go app, simple auth needs, minimal ops footprint.
- You don't need SSO across applications or SAML/OIDC federation.
When to Choose Keycloak
- Multiple apps/services need centralized SSO, or you must speak SAML/OIDC/LDAP.
- You can operate a Java service with HA and upgrade discipline.