Ory Kratos is nowhere near Keycloak. First of all, one needs at least Kratos+Hydra (there’s an integration method now out of the box yay) but Keycloak still has a flexibility advantage. Keycloak has many more features out of the box comparing to the complete Ory stack.

The only thing nicer in Kratos from Keycloak is the standalone self-service UI with JSON identity declaration. If someone from the Keycloak team is reading this, please, let’s have a talk about bringing that feature to Keycloak, then Keycloak will be perfect. The template approach is a bit of a hassle.

Source: deployed both stacks in production systems.

Another significant advantage of Kratos is that it's written in Golang, so it takes little to none resources for simple use cases.

Also my experience with Keycloak in the past was that you can't do zero downtime deployment, or true configuration as code.

I have, and we went back to keycloak- everything the parent says is true, however Ory/Kratos is a lesson in half finished solutions and poor documentation.

we really tried quite hard, since it was backed by CNCF, but it could just be a case of being a tad too immature for prime time.

it seems keycloak is now CNCF though

Found Ory (Kratos) customised registration flow as something over-engineered for my personal use cases.

Very impressive ecosystem nevertheless.

Show HN: Ory Kratos https://news.ycombinator.com/item?id=31679811

Most HN comments are still relevant

What's nice about Ory Kratos/Hydra/Oathkeeper is that you can set 'groups' for your individual clients. In Keycloack that'd have to be a realm per client and if you have more than a couple, screw it. Don't know if something changed with Keycloack in last two years, but that's what nudged us towards Ory. Also, not sure how fast keycloack can get (plus caching) if you want to put it on-front of an API as an auth and throttle solution (you probably can't).