Open source SSO for PCI DSS requirement 8

The assessor will look for a configuration export showing the password policy applied to the realm or organization that authenticates CDE users. In Keycloak, the realm's password policy and the realm export (for example, a JSON export taken with the admin tooling) show minimum length, character rules and history settings. In authentik, the password policy objects and the flow bindings that use them serve the same purpose, and password history is an enterprise-only feature according to the authentik pricing page. Confirm with your assessor whether a point-in-time export, a live screenshot, or both will be accepted, and make sure the export shows the policy actually bound to CDE login flows, not just a policy that exists.

The assessor will compare a current user list against HR or termination records and check that terminated users lost access immediately (Requirement 8.2.5) and that inactive accounts were removed or disabled within 90 days (Requirement 8.2.6). The identity provider produces the user list with last login timestamps and enabled or disabled status, such as Keycloak's user search with its session and login data, or authentik's user directory. Your identity lifecycle source, such as an HR system or the identity governance platform midPoint if you run one, produces the termination events. Keep dated review reports, since a static list without dates rarely satisfies an assessor.

The assessor will check that MFA is required for CDE access (Requirements 8.4.1 to 8.4.3) and that the factors used meet the two-factor-type rule in Requirement 8.5.1. The identity provider produces the evidence: the authentication flow configuration that requires an OTP or WebAuthn step, the list of enrolled credentials per user with factor type, and login event logs showing the second factor succeeded. Keycloak exposes credentials per user through the admin console and admin API, and authentik records authentication events. Confirm with your assessor how they want factor types categorized, and whether passkeys synced across devices need separate justification under the PCI SSC FAQ on synced passkeys.

The assessor will check the lockout threshold (no more than 10 invalid attempts, locked for at least 30 minutes or until identity is confirmed, under Requirement 8.3.4) and the idle session timeout under Requirement 8.2.8. Export the brute force detection settings and the session timeout values from the realm or the authentik flow and session configuration, then show them applied to the CDE clients. Keep a dated record of a test lockout and a test session expiry, because a configuration file alone may not show the control operating. Confirm the exact evidence format with your assessor and your QSA before testing in production.

The assessor will look for an audit trail of administrative changes to authentication policies, client registrations and user privileges, with the actor, time and before-and-after values. In Keycloak, admin events and the event listener configuration record administrative operations when enabled, and the configuration should be forwarded to a central log store so the records cannot be edited by the same administrators. authentik's enhanced audit logging is listed as enterprise-only on its pricing page, so confirm what your edition records. Check that the logs are retained for the period your assessor expects and that someone reviews them, because the existence of logs alone is weak evidence.

The assessor will check that vendor and third-party accounts are uniquely identified, enabled only when needed under Requirement 8.2.7, and protected with MFA for remote access under Requirement 8.4.3. Produce a register of third-party accounts with the business owner, approval record, access scope and enablement window, then show the identity provider groups or roles that match those approvals. The identity provider shows the account state and the MFA enrollment, while a ticketing or approval system holds the sign-off. Ask your assessor whether they want the approval record stored with the account or in a separate access review.

DeployOpen can plan, configure and document the identity provider and the evidence it produces, including exports, review procedures and test records, as part of a fixed-scope engagement with written deliverables. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue reports, attestations or certifications. The Report on Compliance is completed by a Qualified Security Assessor and the Attestation of Compliance is produced on PCI SSC templates, so the assessor decides what evidence is sufficient. Agree the evidence list with your QSA before the engagement starts, and ask the partner to deliver it in a format the assessor has confirmed.

No. A self-hosted identity provider such as Keycloak or authentik can implement the controls Requirement 8 asks for, including unique IDs, password rules, MFA into the cardholder data environment and replay-resistant MFA, but it covers only part of the assessment. Requirement 8 also depends on how accounts are provisioned and removed, how application and system accounts are handled, how the CDE is segmented, and how the configuration and logs are evidenced. Those controls sit with your processes and other systems. Confirm the scope of your assessment with your acquirer or QSA before you design anything, because the Attestation of Compliance is issued by the assessor and the payment brands, not by the software vendor.

Cost comes from four areas: infrastructure and database hosting, integration work per application, the MFA rollout to staff and remote users, and ongoing support. Open-source software has no license fee for Keycloak or the community edition of authentik, but you still pay for hosting, staff time and any paid edition. The main cost drivers are how many applications must integrate, how many use legacy protocols or cannot use SAML or OIDC at all, whether you consolidate several directories, and how many users need new factors. If you consider authentik's Enterprise edition, its pricing page lists $5 per user per month billed annually plus $0.02 per external user per month, with Enterprise Plus starting at $20k annually. Ask any partner for a written quote that separates one-time work from recurring costs.

Duration depends on the number of applications, the state of your directories and the change windows you can use, so no general timeline applies. Your team must provide application owners who can confirm protocols and test logins, a directory or HR source for accounts, and a decision on the MFA methods you will accept. You also need a working conversation with your QSA early, to agree how the controls will be evidenced and whether any requirement will use the customized approach. Plan change windows for cutover in the CDE and for any remote access changes. A fixed-scope written plan from a partner should state the phases and dependencies before work begins.

Often yes, if you have engineers who can operate PostgreSQL, containers or Kubernetes, and manage TLS, backups and identity protocols. The hard parts are rarely the first install. They are the highly available design, the upgrade process, MFA enrollment at scale and the evidence package for the assessor. Ask yourself whether you can staff on-call coverage for the identity provider, since it sits in front of every CDE login. A partner can plan, implement, harden, document and support the platform inside your own cloud account or data center, which is useful if your team has no spare capacity. Either way, the assessor will expect documented ownership of the system.

Keycloak's documented high availability designs, including a single cluster spread across availability zones and the multi-cluster v2 design, both require a synchronously replicated database. The reason is consistency: if a login session or token write is acknowledged by one node but not yet present on another, a failover can lose state or produce inconsistent results. For a PCI DSS environment, that also affects the reliability of authentication logs. Check the database guide for the supported engines, which include PostgreSQL 14 to 18 among others, and confirm replication behavior with your database team. The deprecated multi-cluster v1 design used a separate Infinispan cluster per site, so new designs should follow the current documentation.

Test every upgrade in a non-production environment that mirrors your production configuration, then promote it through change control. Keycloak plans four minor releases a year, and since version 26.0 breaking changes in minor releases are opt-in, which makes testing more predictable. The Keycloak Operator documentation strongly recommends manual approval mode for operator updates. Keycloak also migrates its database schema automatically at startup by default, but the upgrading guide suggests manual migration for large deployments. For authentik, the security policy lists 2026.5.x and 2026.8.x as supported and announces security releases at least 24 hours in advance. Keep a tested rollback path and record each change for your evidence file.

Requirement 8.2.6 requires inactive user accounts to be removed or disabled within 90 days of inactivity, and Requirement 8.2.5 requires access for terminated users to be revoked immediately. A self-hosted identity provider can disable accounts automatically based on last login time, but the rule only works if the identity provider receives reliable termination signals from HR or your directory. Build a scheduled report or job that lists accounts approaching the threshold, and keep the logs that show each disablement. Ask your QSA how the inactivity measure applies to service and system accounts, since those are handled differently. PCI SSC FAQ 1066 addresses inactive accounts and is a useful reference for your team.