Keycloak can manage SSO and roles. We don't have the concept of groups or permissions. Role groups are something we call a "composite role". The way roles work is that you can have realm-level roles, or roles that are associated with an application/client. You can federate user storage in AD and DBs together. ADs should probably work out of the box with some configuration. DBs would take custom coding to work with your schema, but was have an SPI for it. I don't know how Shibboleth compares to Keycloak. We're moving fast though. We currently rely on Picketlink for our SAML client adapter. That's it though. In the near future we will be porting the PL SAML client adapter to Keycloak. On 6/17/2015 3:03 AM, Subhrajyoti Moitra wrote: -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com