One other major problem with Gluu -- where is its security track record? Where do they keep track of security issues and the appropriate fixes to patch them? If it's on their site, it's hard to find, but then most things on the Gluu site _are_ hard to find.

They don't even make a list of their most prominent customers public on their site.

Keycloak, on the other hand, is supported by RedHat, so any advisories relating to it come out through their normal advisory system. A user considering Keycloak or OpenAM is in a much better spot to make an informed decision about security than one considering Gluu, for these reasons.

We strongly considered Gluu, but it's not far enough along.