Open-source identity providers and single sign-on servers in 2026
69 open-source projects, ranked by GitHub stars and how recently each was worked on. Keycloak leads with 38k stars, ahead of Better Auth. 63 had code pushed in the last three months. Most common licenses: Apache-2.0 (31), MIT (17) and AGPL-3.0 (6). Commercial identity providers and single sign-on servers are listed separately.
New this season
-
1
openGym DuarteSantos8
Open-source gym & body-weight tracker, now in the App Store (iPhone + Apple Watch) and as an Android APK. Plan routines, log workouts, see which muscles are trained, import from Strong/Hevy/FitNotes. Self-host it or use it on the phone alone.
Complete system Experimental You want a free workout log you can self-host or keep on your phone, without a subscription app.
★ 19k AGPL-3.0 JavaScript Active, pushed today
All open-source identity providers and single sign-on servers, ranked
Complete systems you can adopt 22
-
1
Authelia authelia
The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.
Complete system Production-ready You self-host several web apps behind Nginx, Traefik or Caddy and want one login with MFA in front of them.
★ 29k Apache-2.0 Go Active, pushed today -
2
openGym DuarteSantos8
Open-source gym & body-weight tracker, now in the App Store (iPhone + Apple Watch) and as an Android APK. Plan routines, log workouts, see which muscles are trained, import from Strong/Hevy/FitNotes. Self-host it or use it on the phone alone.
Complete system Experimental You want a free workout log you can self-host or keep on your phone, without a subscription app.
★ 19k AGPL-3.0 JavaScript Active, pushed today -
3
Casdoor casdoor
An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
Complete system Production-ready You want a self-hosted SSO and user management server that is simpler to run than Keycloak.
★ 15k Apache-2.0 Go Active, pushed today -
4
CAS apereo
Apereo CAS - Identity & Single Sign On for all earthlings and beyond.
Complete system Production-ready A university or large organisation needs a self-hosted SSO hub across many legacy and modern apps.
★ 11k Apache-2.0 Java Active, pushed today -
5
Hanko teamhanko
Modern authentication, on your terms. Open source alternative to Auth0, Clerk, WorkOS, Stytch.
Complete system Usable You want passkey-first login with drop-in UI components and the option to self-host.
★ 9.1k AGPL-3.0 Go Active, pushed today -
6
Kanidm kanidm
Kanidm: A simple, secure, and fast identity management platform
Complete system Usable You want a modern self-hosted replacement for FreeIPA or OpenLDAP to manage people and Linux logins.
★ 5.5k MPL-2.0 Rust Active, pushed today -
7
SyncTV synctv-org
Synchronized viewing, theater, live streaming, video
Complete system Usable You want to watch videos in sync with friends on your own server.
★ 2.5k MIT Rust Active, pushed today -
8
Authgear-server authgear
Open source Auth0/Keycloak alternative. Passkeys, SSO, MFA, passwordless, biometric login. Self-hosted or cloud. Enterprise-ready for SaaS & mobile apps
Complete system Usable A SaaS or mobile app team wants Auth0-style customer login it can self-host or buy as cloud.
★ 2.1k Apache-2.0 Go Active, pushed today -
9
MaxKey dromara
Dromara MaxKey 🗝️ SSO ,Leading-Edge IAM-IDaas(Identity and Access Management) Product , Under Apache-2.0 is free ，业界领先的IAM-IDaas身份管理和认证产品，遵循Apache-2.0开源免费，支持OAuth2.x、OpenID Connect、SAML2.0、CAS、JWT、SCIM等SSO标准协议，基于RBAC统一权限控制，实现用户生命周期管理，开源、安全、合规、自主可控。
Complete system Production-ready A Chinese organisation needs self-hosted SSO and identity management that meets domestic compliance needs.
★ 2k Apache-2.0 Java Active, pushed 6 days ago -
10
privacyIDEA privacyidea
:closed_lock_with_key: multi factor authentication system (2FA, MFA, OTP, FIDO Server)
Complete system Production-ready An organisation needs on-premises MFA across VPNs, Windows logins and applications under its own control.
★ 1.8k AGPL-3.0 Python Active, pushed today -
11
Rauthy sebadob
Single Sign-On Identity & Access Management via OpenID Connect, OAuth 2, PAM
Complete system Usable You want a small, low-resource OIDC provider for self-hosted apps instead of Keycloak.
★ 1.4k Apache-2.0 Rust Active, pushed 3 days ago -
12
FreeIPA freeipa
Mirror of FreeIPA, an integrated security information management solution
Complete system Production-ready You manage many Linux servers and need centralised logins, sudo rules and certificates, often alongside Active Directory.
★ 1.3k GPL-3.0 Python Active, pushed today -
13
ArkID longguikeji
一账通是一款开源的统一身份认证授权管理解决方案，支持多种标准协议(LDAP, OAuth2, SAML, OpenID)，细粒度权限控制，完整的WEB管理功能，钉钉、企业微信集成等，QQ group: 167885406
Complete system Usable A Chinese organisation needs SSO across internal apps and integration with DingTalk or WeCom.
★ 1.3k AGPL-3.0 Python Active, pushed 13 days ago -
14
TheIdServer Aguafrommars
OpenID/Connect, OAuth2, WS-Federation and SAML 2.0 server based on Duende IdentityServer and ITFoxtec Identity SAML 2.0 with its admin UI
Complete system Usable A .NET shop wants an IdentityServer-based provider with a ready admin interface.
★ 756 Apache-2.0 C# Active, pushed today -
15
Melody Auth ValueMelody
A turnkey OAuth & authentication system, designed for both Cloudflare Workers and Node.js
Complete system Usable You want your own auth server on Cloudflare's edge without paying for Auth0.
★ 651 MIT TypeScript Active, pushed 7 days ago -
16
Syncope apache
Apache Syncope
Complete system Production-ready An enterprise needs open-source identity lifecycle management and provisioning, not just login.
★ 346 Apache-2.0 Java Active, pushed today -
17
Goiabada leodip
Goiabada is an OAuth2 / OpenID Connect server written in Go.
Complete system Usable You need a small, understandable auth server for a few apps and find Keycloak too heavy.
★ 204 MIT Go Active, pushed today -
18
Boruta-server malach-it
Identity and Access Management server, manage authentication, authorization and access control up to decentralized identity
Complete system Experimental You run Elixir infrastructure or need verifiable credentials and want an auth server in the same ecosystem.
★ 194 Apache-2.0 Elixir Active, pushed today -
19
FusionDirectory fusiondirectory
FusionDirectory is a modern, efficient and secure Identity Management (IAM) solution.
Complete system Usable Your organisation runs OpenLDAP and administrators need a web UI to manage it.
★ 189 GPL-2.0 PHP Active, pushed 29 days ago -
20
SPIKE spiffe
SPIKE is a lightweight secrets store that uses SPIFFE as its identity control plane. It protects your secrets and helps your ops, SREs, and sysadmins manage sensitive data securely with minimal overhead.
Complete system Experimental You already use SPIFFE or SPIRE for workload identity and want secrets management that plugs into it.
★ 180 Apache-2.0 Go Active, pushed 43 days ago -
21
Guardian dream-horizon-org
Complete system Experimental You want a self-hosted consumer login service in Java and accept an early project.
★ 141 MIT Java Active, pushed yesterday -
22
GrantForge devlive-community
GrantForge (formerly AuthX) is an open-source (MIT) unified permission platform. It answers two questions in one place: who can do what (functional authorization) and who can see which data (data and field authorization).
Complete system Usable A Java team needs central RBAC and ABAC with row and field-level rules across several Spring services.
★ 106 MIT Java Active, pushed 2 days ago
Building blocks for your own system 39
-
1
Keycloak keycloak
Open Source Identity and Access Management For Modern Applications and Services
Building block Production-ready You need self-hosted SSO across many applications with enterprise protocols and no licence fees.
★ 38k Apache-2.0 Java Active, pushed today -
2
Better Auth better-auth
The most comprehensive authentication framework
Building block Production-ready You are building a TypeScript web app and want auth in your own codebase and database instead of a hosted service.
★ 31k MIT TypeScript Active, pushed yesterday -
3
Devise heartcombo
Flexible authentication solution for Rails with Warden.
Building block Production-ready You are building a Rails app with conventional email and password accounts.
★ 24k MIT Ruby Active, pushed 27 days ago -
4
Casbin apache
Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.
Building block Production-ready Your application needs configurable permission rules without writing an authorisation engine.
★ 20k Apache-2.0 Go Active, pushed today -
5
ZITADEL zitadel
ZITADEL - Identity infrastructure, simplified for you.
Building block Production-ready You build a B2B SaaS that needs per-customer organisations and SSO without assembling it yourself.
★ 16k AGPL-3.0 Go Active, pushed today -
6
Logto logto-io
🧑🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.
Building block Production-ready You want an Auth0-like service with ready sign-in screens that you can self-host or use as cloud.
★ 15k MPL-2.0 TypeScript Active, pushed today -
7
OPA open-policy-agent
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
Building block Production-ready You want one policy language across Kubernetes, CI, APIs and infrastructure, with policies kept outside application code.
★ 12k Apache-2.0 Go Active, pushed today -
8
Dex dexidp
OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
Building block Production-ready You need a lightweight OIDC front for existing identity providers, especially for Kubernetes and internal tools.
★ 11k Apache-2.0 Go Active, pushed today -
9
Django-allauth pennersr
Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/
Building block Production-ready You build a Django site that needs user accounts and social or SSO login.
★ 10k MIT Python Active, pushed 3 days ago -
10
Pocket ID pocket-id
The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.
Building block Usable You want single sign-on with passkeys for a homelab or small team without Keycloak's complexity.
★ 9.9k BSD-2-Clause Go Active, pushed today -
11
SpiceDB authzed
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
Building block Production-ready Your app needs fine-grained, relationship-based permissions such as sharing, teams and nested folders across services.
★ 7.2k Apache-2.0 Go Active, pushed yesterday -
12
CASL stalniy
CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access
Building block Production-ready You need the same permission rules in front end and back end of a JavaScript app.
★ 7.1k MIT TypeScript Active, pushed today -
13
Oauth2-server thephpleague
A spec compliant, secure by default PHP OAuth 2.0 Server
Building block Production-ready You need to issue OAuth tokens from a PHP application; Laravel Passport is built on it.
★ 6.7k MIT PHP Active, pushed 9 days ago -
14
Lldap lldap
Light LDAP implementation
Building block Usable Your homelab or small office needs a central user directory and full OpenLDAP is overkill.
★ 6.6k GPL-3.0 Rust Active, pushed 37 days ago -
15
Next-auth nextauthjs
Authentication for the Web.
Building block Production-ready You maintain an existing Next.js app on NextAuth or need stateless sessions without a database.
★ 28k ISC TypeScript Slowing, pushed 3 months ago -
16
OpenFGA openfga
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
Building block Production-ready You need fine-grained permissions as a separate service and want a vendor-neutral, CNCF-governed option.
★ 6.1k Apache-2.0 Go Active, pushed today -
17
Permify Permify
An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉
Building block Usable You want a fine-grained permission service with a readable schema and testing tools.
★ 6k AGPL-3.0 Go Active, pushed yesterday -
18
Doorkeeper doorkeeper-gem
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.
Building block Production-ready Your Rails app needs to offer an OAuth API to third-party or mobile clients.
★ 5.5k MIT Ruby Active, pushed today -
19
Authlib authlib
The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included.
Building block Production-ready You implement OAuth or OIDC in Python, either consuming providers or running your own server.
★ 5.4k BSD-3-Clause Python Active, pushed today -
20
Keto ory
The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.
Building block Usable You already use Ory Kratos or Hydra and want permissions from the same stack.
★ 5.4k Apache-2.0 Go Active, pushed 2 months ago -
21
Cerbos cerbos
Cerbos is an open-core authorization management platform for authorizing every identity and governing every action across applications, gateways, workloads, and AI agents.
Building block Production-ready You want authorization rules out of application code but do not want to sync relationship data into another database.
★ 4.6k Apache-2.0 Go Active, pushed today -
22
Hydra ory
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
Building block Production-ready You already have user accounts and need a standards-compliant OAuth2/OIDC provider in front of them.
★ 18k Apache-2.0 Go Slowing, pushed 3 months ago -
23
Node-oidc-provider panva
OpenID Certified™ OAuth 2.0 Authorization Server implementation for Node.js
Building block Production-ready You need your Node.js app to act as a standards-compliant identity provider.
★ 3.8k MIT JavaScript Active, pushed today -
24
Oauth2 go-oauth2
OAuth 2.0 server library for the Go programming language.
Building block Usable You need a basic OAuth 2.0 token server embedded in a Go service.
★ 3.6k MIT Go Active, pushed 2 months ago -
25
OpenSK google
OpenSK is an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.
Building block Experimental You research security keys or build your own hardware token for experimentation.
★ 3.5k Apache-2.0 Rust Active, pushed 4 days ago -
26
Kratos ory
Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.
Building block Production-ready You want to own your login system and build your own UI on top, rather than use a hosted provider's screens.
★ 14k Apache-2.0 Go Slowing, pushed 3 months ago -
27
SimpleWebAuthn MasterKale
WebAuthn, Simplified. A collection of TypeScript-first libraries for simpler WebAuthn integration. Supports modern browsers, Node, Deno, and more.
Building block Production-ready You add passkey login to a JavaScript or TypeScript app and want the WebAuthn details handled.
★ 2.4k MIT TypeScript Active, pushed 5 days ago -
28
Fido2-net-lib passwordless-lib
Passkeys, FIDO2 and WebAuthn .NET library.
Building block Production-ready You add passkey authentication to a .NET application.
★ 1.5k MIT C# Active, pushed 5 days ago -
29
Topaz aserto-dev
Cloud-native authorization for modern applications and APIs
Building block Usable You want OPA-based policies plus relationship data in one local authorizer.
★ 1.4k Apache-2.0 Go Active, pushed 3 days ago -
30
WebAuthn go-webauthn
FIDO2 Conformant WebAuthn and Passkey backend library for golang
Building block Production-ready You add passkey login to a Go server.
★ 1.4k BSD-3-Clause Go Active, pushed 5 days ago -
31
Py_webauthn duo-labs
Pythonic WebAuthn 🐍
Building block Production-ready You add passkey login to a Python web app.
★ 1.1k BSD-3-Clause Python Active, pushed 25 days ago -
32
WebAuthn ruby cedarcode
WebAuthn ruby server library ― Make your Ruby/Rails web server become a conformant WebAuthn Relying Party
Building block Production-ready You add passkey or security-key login to a Ruby app.
★ 777 MIT Ruby Active, pushed 10 days ago -
33
Webauthn-rs kanidm
An implementation of webauthn components for Rustlang servers
Building block Usable You add passkey authentication to a Rust web service.
★ 717 MPL-2.0 Rust Active, pushed 4 days ago -
34
Polis ory
Streamline your web application's authentication with Polis, an SSO service supporting SAML and OpenID Connect protocols. Beyond enterprise-grade Single Sign-On, it also supports Directory Sync via the SCIM 2.0 protocol for automatic user and group provisioning/de-provisioning.
Building block Production-ready Enterprise customers ask your SaaS for SAML SSO and SCIM and you do not want to switch identity providers.
★ 2.3k Apache-2.0 TypeScript Slowing, pushed 3 months ago -
35
Warrant warrant-dev
Warrant is a highly scalable, centralized authorization service based on Google Zanzibar. Use it to define, enforce, query, and audit application authorization and access control.
Building block Usable Only if you already run it; new projects are better served by SpiceDB or OpenFGA.
★ 1.3k Apache-2.0 Go Slowing, pushed 11 months ago -
36
AspNetSaml jitbit
Very simple SAML 2.0 consumer module for ASP.NET/C#
Building block Production-ready You need to add basic SAML login to a .NET app without a heavy library.
★ 418 Apache-2.0 C# Active, pushed 6 days ago -
37
Open.IdentityServer RockSolidKnowledge
A free open source OpenID Connect and OAuth 2.0 framework for ASP.NET Core, based on IdentityServer4
Building block Usable You run IdentityServer4 and want a maintained Apache-licensed path instead of buying Duende IdentityServer.
★ 189 Apache-2.0 C# Active, pushed today -
38
Authzed-go authzed
Official SpiceDB client library for Go
Building block Production-ready You call SpiceDB from Go services.
★ 104 Apache-2.0 Go Active, pushed 39 days ago -
39
Ruek uatuko
🔐 Lightning fast, global scale authorization service without the overhead of a yet another DSL.
Building block Experimental Only for experiments with a minimal, fast authorization service.
★ 101 Apache-2.0 C++ Slowing, pushed 9 months ago
Integrations 5
-
1
Caddy-security greenpau
🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐
Integration Usable You already use Caddy and want authentication at the proxy without running a separate SSO server.
★ 2.3k Apache-2.0 Go Active, pushed 6 days ago -
2
Play-pac4j pac4j
Security library for Play framework 2/3 in Java and Scala: OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT...
Integration Production-ready You build on Play and need multiple authentication protocols.
★ 414 Apache-2.0 Java Active, pushed 8 days ago -
3
Hass-openid cavefire
OIDC integration for Home Assistant
Integration Usable You run Home Assistant with a self-hosted SSO provider and want single sign-on.
★ 214 GPL-3.0 Python Active, pushed 23 days ago -
4
Jellyfin-plugin-sso K0lin
This plugin allows users to sign in through an SSO provider (such as Google, Microsoft, or your own provider). This enables one-click signin.
Integration Usable You run Jellyfin for family or a small group and already use an SSO provider.
★ 180 GPL-3.0 C# Active, pushed today -
5
Spark-pac4j pac4j
Security library for Sparkjava: OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT...
Integration Usable You maintain a Spark Java app and need standard authentication protocols.
★ 163 Apache-2.0 Java Active, pushed 7 days ago
Developer tools 2
-
1
Yubikey-manager Yubico
Python library and command line tool for configuring any YubiKey over all USB interfaces.
Developer tool Production-ready You set up or administer YubiKeys from scripts or the terminal.
★ 1.2k BSD-2-Clause Python Active, pushed 4 days ago -
2
Melange pthm
OpenFGA-to-PostgreSQL authorization compiler. Generates specialized SQL functions from .fga schemas that query your existing tables. Zero sync, always consistent.
Developer tool Experimental You like OpenFGA's model but want permission checks inside Postgres without syncing a separate store.
★ 107 MIT Go Active, pushed today
Templates and starters 1
-
1
Webauthn.io duo-labs
The source code for webauthn.io, a demonstration of WebAuthn.
Template or starter Usable You want a reference implementation to learn how WebAuthn ceremonies work in practice.
★ 746 BSD-3-Clause Python Active, pushed 3 months ago
Compared head to head
Looking for an alternative to
Open-source licenses
- Permissive: 55. Use it anywhere, including in closed products. You keep the copyright notice; Apache-2.0 also grants patent rights.
- Network copyleft: 6. Like GPL, and running a changed version as a web service counts as distributing it, so its users get the source too.
- Strong copyleft: 5. If you distribute the program or anything built on it, you must release the whole source under the same license.
- Weak copyleft: 3. Changes to the licensed files must be shared, but you can link them into a closed program.
Languages
Go 25, Python 9, Java 8, TypeScript 7, Rust 6, C# 5, Ruby 3, JavaScript 2, PHP 2, Elixir 1 and C++ 1.
Made software that belongs here? Add it. Listing is free.