scim-for-keycloak

Likely this one which I am aware of: https://github.com/Captain-P-Goldfish/scim-for-keycloak An wonderful piece of work. Note, however, that the most recent supported Keycloak version is 16.1.x. Whereas Keycloak has recently been reworked (beginning with 17.x, now at 18.x) around Quarkus. This is awkward to explain to stakeholders that understand the implications of having their authentication system held back due to dependencies. SCIM is a well designed and standards based (RFCs even!) expression of identity management in REST. Expecting identity platforms to support it as a first class capability is reasonable.

I've used both the opensource WSO2 and Keycloak. That latter is better designed and suffers fewer glitches, which is important when dealing with the complexities of oidc/oauth2. It's not that WSO2 doesn't do what it says on the tin; it works. Keycloak just works so well it's almost fun. One feature Keycloak lacks compared to WSO2 is SCIM (System for Cross-domain Identity Management). That actually matters to me. There is a third party Keycloak extension[1] that implements SCIM, but I can't speak to it. [1] https://github.com/Captain-P-Goldfish/scim-for-keycloak

Keycloak has nearly all of this built in. You don’t need to be a crack sysadmin to set it up. If all you need is a 2FA-enabled OIDC endpoint federating to AD/LDAP to serve as SSO you can be up and running quite quickly. [1] 2FA/Time based OTP: https://www.keycloak.org/docs/12.0/server_admin/keycloak-ima... [2] LDAP/AD (Kerberos) https://dmc.datical.com/z_resources/images/assets/screenshot... [3] SCIM (third party) https://github.com/Captain-P-Goldfish/scim-for-keycloak