browser -> Gate One -> Keycloak/Zitadel -> Google or another IdPMultiple identity providers
Use a classical OIDC IAM such as Keycloak or Zitadel to federate several identity providers behind one issuer.
Useful if you want to…
accept users from several identity providers (Google, Microsoft, GitHub, a corporate directory, …);
keep one issuer and one login surface for Gate One;
centralize user policy, roles and federation in an existing IAM;
avoid adding another identity service to the platform.
The classical pattern: an external IAM
Usefull if you already use one
An OIDC IAM such as Keycloak or Zitadel can federate several
IdPs itself. In that pattern:
users authenticate against the IAM;
the IAM delegates to Google, Microsoft or another upstream IdP;
the IAM applies users, groups, roles and policies;
Gate One points at one OIDC issuer — the IAM — and never sees the upstream IdPs.
Keycloak and Zitadel are common open-source choices. They already provide the IAM features you need: identity-provider federation, user directory, groups/roles, account management and an admin console.
The complete Gate One + Keycloak + Google setup is in the Keycloak with Google example.
The embedded alternative: cladone-auth
If you do not want to run an external IAM, Gate One ships the optional
embedded IAM cladone-auth. It is a lightweight OIDC issuer that:
federates external IdPs, so it is not an IdP itself;
keeps one login surface and one issuer for Gate One;
maps IdP IAM fields into a common roles/scopes/claims model;
manages per-user grants for both local and federated users.
It is deliberately resource-light: the recommended path uses external IdPs, so there is no password store and no password-hashing cost. Local accounts are optional for small deployments.
It is a lightweight IAM, not a full replacement for Keycloak/Zitadel: no per-resource policy engine, no admin UI, no multi-identity linking.
Feature: Embedded IAM
Example: Embedded IAM example
The simplest case: one IdP, direct OIDC
If you have a single identity provider that already carries the roles and
scopes your routes need, point Gate One straight at it: one oidc
provider, no federation, no embedded IAM. See the
Direct OIDC example.
Choosing
| If you… | Use |
|---|---|
Already run Keycloak, Zitadel, Entra or Auth0 | that IAM as the single OIDC issuer |
Want federation without another IAM service |
|
Have only one IdP | direct |
Need full user lifecycle, admin console and enterprise policies | an external IAM such as Keycloak or Zitadel |
In both patterns Gate One trusts one issuer and applies route policy locally; the difference is where user federation and administration live.
Important |
|