I’ve been pondering a deep dive into Keycloak or Ory. Or is WorkOS good enough for the price?
I’m looking to centralize account management across multiple systems.
It's super powerful and can do whatever you want it to do (at least if you are comfortable writing Java SPI). But there's a lot of knowledge of how to set things up that takes time and is not readily acquired.
For the record we looked at Ory early on, but it was not mature enough and didn't offer a full IdP stack at the time. We've since looked again and found there to be some conventions around how it works that made it hard for us to consider migrating from Keycloak.
WorkOS has messed up SCIM integrations for us/our customers serveral times, and now with agentic stuff I'd just build out SCIM support myself (done it pre agents so maybe not for everyone), they're also kinda expensive and have hard lockin since they're not going to hand out your customer SAML/SCIM/whatever configs and password hashes.
Ory's got a nice cloud offering (only used it self hosted) but the whole stack is there and it's IMO easier to understand than keycloak (and you probably don't want to build your own)
I would also rather admin/bug fix/operate a go service than a java service (personally). Keycloak is not terrible though you have enough rope to really get yourself in a bind.
Personally I choose Keycloak, but Ory is not a bad choice at all if you are willing to do more upfront work.