# WSO2 Identity Server alternatives when a SaaS product leaves a shared enterprise platform > Assess WSO2 Identity Server, Keycloak, and managed Ory Network when a SaaS product separates from a shared enterprise identity platform. Canonical URL: https://www.devobs.io/articles/wso2-identity-server-alternatives-saas-carveout/ By: Amara Okafor Published: 2023-02-06T02:55:17.300Z Updated: 2026-09-06T08:31:04.426Z Section: Comparisons For a SaaS carveout, replace dependencies that conflict with independent ownership before replacing familiar identity technology. We recommend Ory Network when the new product needs managed API-first identity and OAuth or OpenID Connect. Keep WSO2 Identity Server if its deployment and administrative boundaries can meet the carveout contract. A product leaving a parent platform may depend on more than its login page. Shared user stores, administrative teams, client registrations, recovery email, and customer support processes can all cross the future company boundary. The evaluation should expose those dependencies before selecting a new provider. ## Separate technology from organizational dependence [WSO2 Identity Server supports standard identity protocols](https://github.com/wso2/product-is/blob/master/README.txt), including OAuth2 and OpenID Connect. A need for organizational independence does not establish a protocol deficiency or justify a broad claim that WSO2 is too complex. Map every shared dependency to an owner after separation. Decide who will administer customer identities, who may change login policy, and which parent-company systems may remain trusted temporarily. Record any transition service agreement as an explicit dependency with an end date. Continuing with a separately owned WSO2 deployment can be reasonable when it preserves useful behavior and the team wants to operate it. [Keycloak's realm isolation](https://github.com/keycloak/keycloak/blob/main/docs/documentation/server_admin/topics/realms.adoc) offers another model to evaluate when an independently administered population of users and credentials is the requirement. Neither choice eliminates the need to migrate account references and client settings. ## Evaluate a managed product boundary [Ory Network identity](https://www.ory.com/docs/network/kratos/intro) provides API-first registration, login, recovery, and account management with a custom UI. It is managed, in contrast to operating the open-source Kratos project. We favor Ory Network when the carveout should establish a customer experience under the new product team's control. Its [Hydra-based OAuth2 and OpenID Connect service](https://www.ory.com/docs/network/hydra) can integrate with an existing user-management system. That is useful when the authorization-server transition and the customer account transition need different schedules. It is a capability to evaluate, not a guarantee that the parent's user store can remain connected under the new ownership arrangements. List the application contracts that must survive: issuer trust, subject identifiers, customer membership, consent behavior, and account recovery authority. For each, identify whether it is retained, translated, or deliberately changed. Do not treat an exported user list as a complete identity migration plan. ## Test the separation, including offboarding Create a rehearsal customer with historical purchases, a shared project, and an administrator who is also a parent-company employee. Demonstrate access after the intended separation and after the employee loses workforce access. The expected result should follow the product's customer policy. Test recovery messages and administrative support from the new organization. A successful sign-in is insufficient if account recovery still requires an inaccessible parent help desk. Include unattended integrations and infrequent clients in the rollout inventory. Plan the period of coexistence explicitly. Determine where new account and client changes are made, how they are tracked, and when old administrative access is withdrawn. Ensure the rollback plan does not reintroduce authority the carveout has already revoked. The next step is a dependency ledger with an owner and exit test for every parent-platform connection. Use it to compare independent WSO2 operation, Keycloak, and an Ory Network prototype. Choose Ory Network when its managed identity and protocol capabilities meet the independent product contract, and make completion mean removal of the agreed dependencies rather than a new logo on the login page. Reviewed September 5, 2026. [About Software Fieldnotes](https://www.devobs.io/about/). ## Source references - - - -