> I need an equivalent to Windows' Active Directory in Linux world that ideally can also federate with/masquerade as AD. Can Vault be such thing?

Vault is not such a thing.

AD is basically LDAP + Kerberos. Neither Vault nor Keycloak can fill that role. You would need Samba 4 setup as a domain controller [1] for that.

If you need AD but for Linux desktops you could take a look at FreeIPA [2].

If your feeling brave you can combine an LDAP server (like Wren:DS, 389 or OpenLDAP) with a Kerberos implementation like MIT Kerberos and create an AD like experience yourself. Though I would not recommend that.

[1] https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Acti...

[2] https://www.freeipa.org/

Vault and Keycloak serve entirely separate use cases. Vault is for storing secrets (passwords, API keys, keypairs and the like).

If you can use public cloud, have you considered Azure Active Directory? We're a Linux shop using it very successfully for on-prem and cloud systems.

I need a self sufficient component, that can be deployed on prem alongside other components, without public cloud dependency.

keycloak is pretty nice for that. You can just drop some docker-compose somewhere (or k8s) or plain wildfly/tomcat and you have saml idp + oauth2 (openid connect) out of the box including ui and self-service for users - it's also completly themeable (that's what I'm doing at the moment for a project)...

you don't even need a ldap/ad in the background but you can connect to one.

however it's strictly for authentication and authorization - basically users + roles

vault is different usecase but can probably be connected.

You might find FreeIPA useful. Its CA component (dogtag) has a KRA component that FreeIPA exposes as 'vaults' for secret storage.

You can even do cross-forest trust to AD, log into your Linux systems as users who live in AD...