Keycloak is a powerful open-source IAM engine — but upstream, you're on your own for long-term support, CVE backports, supported upgrades, and packaging. Aerobase is that same Keycloak, production-hardened: 100% compatible, with a 2-year LTS, security maintenance, and commercial backing.
Upstream Keycloak ships fast — and breaking changes come with it. Aerobase gives you a 2-year LTS line with a supported upgrade path, so you're not forced to re-test your whole stack every quarter.
CVEs don't wait for your upgrade window. Aerobase monitors disclosures and backports fixes onto curated, production-ready builds — without asking you to jump to the latest major version.
Native RPM and DEB packages, a Windows installer, and a hardened Docker edition — instead of assembling and maintaining your own distribution from upstream artifacts.
Same identity engine. The difference is everything around it — lifecycle, security response, packaging and support.
| Capability | Keycloak Upstream community | Recommended Aerobase Supported & LTS |
|---|---|---|
| Identity & Access | ||
| SSO — OpenID Connect, OAuth2, SAML | ✓ | ✓ |
| MFA, WebAuthn, FIDO2, passwordless | ✓ | ✓ |
| LDAP & Active Directory federation | ✓ | ✓ |
| Social login & identity brokering | ✓ | ✓ |
| Fine-grained authorization policies | ✓ | ✓ |
| Lifecycle & Maintenance | ||
| Long-term support (2-year LTS line) | ✗ | ✓ |
| CVE backports to stable builds | Latest major only | ✓ |
| Supported upgrade path | Self-managed | ✓ |
| Curated production-ready builds | ✗ | ✓ |
| Packaging & Deployment | ||
| Self-host on any cloud or on-premise | ✓ | ✓ |
| Linux packages — RPM & DEB | Build your own | ✓ |
| Hardened Docker edition | Community image | ✓ |
| Windows installer (MSI) | ✗ | ✓ |
| Support & Services | ||
| Community forum support | ✓ | ✓ |
| SLA-backed support portal | ✗ | ✓ |
| Security & deployment consulting | ✗ | ✓ |
| Custom identity workflow development | ✗ | ✓ |
| Cloud test instance | ✗ | ✓ |
| keycloak.org | Get Aerobase Free | |
Aerobase is built on Keycloak and stays compatible with it. Keycloak is a trademark of its respective owner; Aerobase is an independent distribution and is not affiliated with or endorsed by the Keycloak project.
Upstream Keycloak hands you a capable engine and a community forum. Running it safely in production means someone owns the lifecycle, the CVEs, the packaging and the custom flows. With Aerobase, that someone is us.
No. Aerobase is a supported distribution built on Keycloak and stays compatible with it. Your realms, clients, themes, extensions and configuration work the same — you're running Keycloak, with the lifecycle and support layer added around it.
You can — it's open source and so is Aerobase. The question is who owns the boring-but-critical parts: tracking CVEs, backporting fixes, validating upgrades, and building OS packages. Aerobase takes that on so your team doesn't have to maintain a private Keycloak distribution.
Because Aerobase is Keycloak, migration is typically a straightforward drop-in: point Aerobase at your existing database or import your realm exports. There's no data model rewrite and no re-integration of your applications.
The Open Source edition is free forever — SSO, MFA, LDAP/AD, the full identity engine, and community-built Linux and Docker packages. Paid plans add SLA-backed support, consulting hours, LTS builds, the Windows installer and a cloud test instance. See Plans & Pricing — no per-user fees, ever.
Start free with the open-source edition, or talk to us about LTS, security maintenance and custom identity work for production.