Estimate for Keycloak SSO Implementation in Legacy Systems

By Kevin Marcondes · Published on Sep 29, 2026 · Updated on Oct 9, 2026 · 7 min read

Woman holding a tablet in front of server racks with reflection in glass — Professional reviewing servers — suitable for SSO, LDAP/AD and Keycloak integration. Photo: Christina Morillo / Pexels

Need an estimate to implement Single Sign-On (SSO) with Keycloak in legacy systems? This guide explains what to include in scope, LDAP/AD integrations, SAML and OIDC support, risks, project phases and effort estimation. Use it to request clear, comparable proposals from vendors.

What an SSO estimate with Keycloak should include

A good estimate clearly states what will be delivered and what is out of scope. For Keycloak SSO, a precise definition avoids surprises during integration with legacy systems.

The items below help you compare proposals fairly and reduce project risk.

Inventory of target applications and their current login methods.
Integration with directories (LDAP/Active Directory) and additional identity sources.
Protocols per application: OIDC, OAuth 2.0 or SAML 2.0.
Flow design: auto-provisioning, account linking, password recovery.
MFA requirements, password policies and auditing.
Environments: dev, staging and production, with a defined rollback plan.
Training and knowledge transfer, when applicable.
Test plan and acceptance criteria per application.

Integration with corporate directories (LDAP/AD)

Keycloak connects to LDAP/Active Directory as a user provider. This bridge allows keeping existing sources of truth without duplicating user records.

In legacy environments, pay attention to required attributes, group synchronization and mapping rules. Schema conflicts and name normalization are common and should be included in the plan.

When custom adapters or middleware are required, consider a tailored development scope. See also the custom software page.

Attribute mapping: sAMAccountName, mail, uid, groups.
Synchronization modes: read-only, controlled write or partial mirroring.
Secure connectivity: LDAPS/TLS, certificates and firewalls.
Directory fallback and high availability.

Protocols and standards: SAML 2.0, OIDC and OAuth 2.0

Keycloak supports SAML 2.0 and OpenID Connect (OIDC). In legacy systems, the choice depends on each application's native support and the effort required for adaptation.

OIDC is typically preferred for modern applications. SAML is common in older corporate software. In both cases, define claims/attributes and signature requirements carefully.

Adjustments in the application may require integration development. For that, consult software development resources.

OIDC: JWT tokens, configurable scopes and claims.
SAML: signed assertions, bindings and attribute mappings.
Single logout (SLO) and distributed session control.
Key rotation and certificate management.

Effort estimation: factors that impact cost

Without exact numbers you can still anticipate effort size based on technical and business variables. This helps request comparable proposals.

Use complexity classifications to guide schedule, staffing and risk planning. The goal is to make dependencies and critical points explicit.

Number of applications and diversity of technologies.
Availability of native SAML/OIDC support or need for adapters.
Directory complexity (multiple domains, trusts, attributes).
MFA, audit and compliance requirements.
Maintenance window and rollback constraints.
Quality of documentation for legacy systems.

Scenario	Characteristics	Typical integrations	Impact risk
Controlled pilot	1–2 apps, native OIDC/SAML support, few adjustments	OIDC with basic claims	Low
Standard AD/LDAP + OIDC integration	Multiple web apps, groups and profiles, optional MFA	AD/LDAP + OIDC with roles and mappings	Medium
Heterogeneous environment with legacy systems	Apps without native support, need for adapters	Mixed SAML and OIDC; bridges and middleware	Medium–High
High criticality with multiple dependencies	Many logins and active sessions, zero-downtime requirements	SLO, key rotation, canary releases	High

Recommended project phases for legacy systems

Defining phases reduces uncertainty and improves risk control. In legacy environments, incremental validation is essential.

When you need broader planning support, see IT consulting resources.

Discovery and assessment: inventory of apps, login flows and requirements.
Architecture design: realms, clients, user providers, secure routes.
Proof of concept (PoC): validate protocol, claims and basic SSO.
Pilot: a user group and one critical application with SLO.
Rollout: include remaining applications in waves, with metrics and rollback.
Operations: monitoring, key rotation and access policies.

Common risks and how to mitigate them

SSO projects touch identity, availability and security. Anticipating risks helps prevent production incidents.

Plan regression tests and failure scenarios. A clear rollback strategy should be part of the estimate.

Account linking: ensure reliable matching between existing users and the new IdP.
Session management: align timeouts between Keycloak and applications.
Key rotation: automate to avoid token validation interruptions.
Partial SLO: handle apps that don’t support unified logout.
MFA: set realistic policies, with exceptions for unsupported systems.
Ongoing operations: document procedures. See also software maintenance resources.

Technical requirements and environment prerequisites

Some items accelerate integration and reduce rework. Gathering this information when requesting a proposal makes estimates more accurate.

Inventory of applications, versions and current authentication methods.
Access to directory (LDAP/AD), schema and group policies.
Certificates, DNS, load balancers and required ports.
Test environments and sample user data.
Compliance and log retention requirements.
Contingency plans and maintenance windows.

How to request a proposal: objective checklist

When asking for an estimate, include practical information. This reduces vague estimates and speeds up vendor comparisons.

If custom integrations are needed, consult software consulting resources.

SSO objective and priority systems for the first wave.
List of applications, supported protocols and expected access patterns.
AD/LDAP details, domains, trusts and key attributes.
MFA, auditing and reporting requirements.
Scheduling constraints and maintenance windows.
Success criteria and acceptance per application.

Frequently asked questions

How much does it cost to implement SSO with Keycloak in legacy systems?

Costs depend on scope: number of applications, protocol support and directory complexity. Projects with native OIDC/SAML support typically need less effort than environments requiring adapters for legacy apps. To get an accurate proposal, provide an application inventory, MFA and auditing requirements, AD/LDAP details, maintenance windows and acceptance criteria so vendors can map phases, risks and staffing needs.

Can Keycloak integrate with existing Active Directory or LDAP?

Yes. Keycloak can use AD/LDAP as a user provider so existing directories remain the source of truth. Estimates should cover attribute mapping, group synchronization mode, secure connectivity (LDAPS/TLS) and authentication testing. In complex setups plan for schema validation or custom adapters; include those items in scope so vendors can size development, synchronization and failover work.

How should existing users and permissions be handled during migration?

Use account linking based on stable identifiers (for example corporate email or unique IDs) and define explicit merge rules to preserve groups and access. Run pilots with representative user samples, apply MFA policies progressively, and document rollback procedures. Include mapping rules, conflict resolution and testing in the estimate to prevent access loss and ensure predictable behavior during cutover.

What is the timeline for a Keycloak SSO project?

Timelines vary with the number of applications, availability of native protocols and directory complexity. Structure the project in phases—discovery, architecture design, PoC, pilot and wave-based rollout—to reduce risk and enable adjustments. Provide business priorities, maintenance windows and acceptance criteria so vendors can propose realistic schedules and phased deliveries that validate integration before full production rollout.

Does Keycloak require a paid license?

Keycloak is open source, so direct licensing fees are usually not required. Project costs typically come from integration, configuration, adapter development, testing, high availability, monitoring and ongoing operations. Specify audit, MFA and support expectations in your request for proposal so estimates cover implementation and run‑time responsibilities rather than software license costs.

Ready to request your Keycloak SSO estimate?

Send the application list, AD/LDAP details, supported protocols and MFA requirements. With this information you’ll receive a focused proposal tailored to your legacy environment.

Send environment details