Self-hosted alternative to WorkOS & Okta

Your B2B SSO Infrastructure. Your Control.

RealmSSO is a self-hosted control plane for enterprise SSO. Deploy it on your own infrastructure, configure SAML, OIDC, and SCIM for your customers, and get full observability — without vendor lock-in.

Get Started Deployment Guide

No vendor lock-in. No per-seat pricing. No per-connection fees.

# realmsso-server chart — values reference at /docs/helm

$ helm upgrade --install realmsso ./helm/realmsso-server \

--set existingSecret=realmsso-secrets \

--set keycloak.url=https://sso.example.com \

--namespace realmsso --create-namespace

✔ Deployed. Keycloak (browser): https://sso.example.com

Built for B2B SaaS companies that need enterprise SSO

SAML 2.0OpenID ConnectSCIM 2.0Kubernetes NativeKeycloak Powered

Everything you need for enterprise SSO

A complete control plane for B2B identity that your customers will love and your team can trust.

SAML 2.0

Full SAML 2.0 support with metadata upload, manual configuration, automatic Keycloak IdP creation, and health checks.

OpenID Connect

OIDC discovery-based configuration with automatic client setup, secret encryption, and comprehensive redirect URI management.

SCIM 2.0 Directory Sync

SCIM 2.0 Users & Groups endpoints with standard schemas and bearer-token auth. Directory writes provision users and groups into Keycloak. Deprovisioning and group sync both ship off by default.

Customer Admin Portal

Branded, embeddable portal for your customers to configure their own SSO. Magic-link access, connection testing, and status monitoring.

Observability & Analytics

Connection-health results, SCIM event activity, an event feed, and a full audit trail — all in one dashboard.

Identity Gateway

Let customers sign in with their own IdP while each application keeps the identity system it already trusts — including one behind existing on-premises federation. Early access: the control plane ships over the API, with no configuration UI yet.

Integration Control

Register an application once and provision its trust configuration into every granted customer tenant, with enablement and audit run centrally. Early access — registration, grants and provisioning ship over the API; central rotation and a UI do not.

Offline Operation

Designed: keeping an already-signed-in user working when their identity provider is unreachable, on a sealed token behind device unlock, for a window the customer sets. Ratified in ADR 0010 and not built; never a fresh login offline.

API & Webhooks

Everything is API-first. RESTful API with API key authentication and SSRF-guarded webhook endpoints you configure from the dashboard.

How it works

Deploy once. Manage all your customers' SSO from one place.

Deploy

Deploy RealmSSO on your Kubernetes cluster with a single Helm command. Bring your own Keycloak or use the bundled one.

Invite Customers

Create accounts and generate Admin Portal access links. Your customers configure their own SAML, OIDC, or SCIM settings.

Monitor & Manage

View all connections, audit logs, and observability from one dashboard.

Self-hosted. Your cluster, your data, your control.

RealmSSO runs entirely on infrastructure you own. Deploy it on your own Kubernetes cluster, connect it to your Keycloak instance, keep every identity record inside your own network boundary, and never worry about per-connection pricing.

Start Deploying Self-Hosting Guide