Issuerd: a Keycloak-compatible IAM in Rust — one binary, 3,907 OIDC conformance checks, zero failures

Description and use

Issuerd is a Keycloak‑compatible IAM written in Rust, delivered as a single binary. It passes 3,907 OIDC conformance checks with zero failures, offers up to 7.8× higher throughput, uses ~6× less memory, and has an image 8.7× smaller than Keycloak.

Problem

Keycloak’s operational overhead—large JVM, long startup, clustering complexity—makes it costly to deploy and maintain in production.

Outcome

Issuerd passes 3,907 OIDC conformance checks with zero failures, matches Keycloak 24.0 behavior, and achieves up to 7.8× throughput, ~6× less memory, and 8.7× smaller image compared to Keycloak 26.7.

Workflow

• Clone issuerd repository
• Run docker compose up to start issuerd
• Access admin console at http://localhost:8080/admin/console with admin/admin credentials
• Use demo realm myrealm with user alice/changeme
• Run official OpenID Foundation Conformance Suite CI to verify 3,907 conditions
• Run dual‑target suite against Keycloak 24.0 to document differences

Evidence

3,907 conditions verified across the Basic OP, Form Post OP, and Config OP profiles — zero failures, zero warnings.

Source

Up to 7.8× throughput, ~6× less memory, 8.7× smaller image vs Keycloak 26.7 in our benchmarks

Source

100,003 users synced from a live Active Directory in ~30 seconds (~3,300 users/s)

Source