Best Self-Hosted SSO & Identity Tools

Self-hosted single sign-on and identity providers let you own your logins — one account across every app, with 2FA, OIDC, and SAML on your terms. The options below range from full identity platforms to lightweight forward-auth gateways; compare them on protocols, footprint, and how much of an identity provider you actually need.

SSO & Identity

Authelia

A lightweight, open-source authentication and authorization server providing 2FA and SSO via a forward-auth portal in front of your reverse proxy — a self-hosted gatekeeper for existing apps, not a full identity provider.

Go

moderateRead guide →

SSO & Identity

authentik

An open-source identity provider supporting SAML, OAuth2/OIDC, and LDAP — a flexible, self-hostable alternative to Auth0, Okta, and Azure AD with a visual flow-based login builder.

PythonGoTypeScript

moderateRead guide →

Ca

SSO & Identity

Casdoor

An identity and access management server with a web admin console that exposes one user directory over OAuth 2.0, OIDC, SAML, CAS, LDAP and SCIM, with Casbin-based authorization policies. It runs as a single Go binary backed by MySQL, PostgreSQL or SQLite.

GoReact

easyRead guide →

SSO & Identity

Keycloak

A mature, enterprise-grade open-source identity and access management server — SSO, SAML, and OpenID Connect with user federation, built on Quarkus and backed by Red Hat.

JavaQuarkus

hardRead guide →

SSO & Identity

LLDAP

A lightweight LDAP server for user and group management with a web UI, built to be the user directory behind Authelia, Keycloak, Nextcloud and other apps that authenticate over LDAP. It implements an opinionated subset of LDAP rather than a full directory server.

RustSQLite

easyRead guide →

SSO & Identity

Logto

An open-source authentication and authorization service built on OIDC and OAuth 2.1, with multi-tenancy, SSO, RBAC and prebuilt sign-in flows for SaaS and AI apps. It runs as a Node.js service on PostgreSQL, with a separate admin console.

TypeScriptNode.jsPostgreSQL

easyRead guide →

SSO & Identity

Pocket ID

A simple, self-hostable OIDC provider that lets users sign in to your apps with passkeys only — no passwords, built for small self-hosted setups that just need lightweight SSO.

GoSvelteKit

easyRead guide →

SSO & Identity

Tinyauth

The tiniest self-hosted login screen for your apps — a single small Go container that adds authentication, OAuth login, and access controls in front of Traefik, Nginx, or Caddy, and since v5 doubles as an OpenID Certified OIDC provider.

Go

easyRead guide →

SSO & Identity

Zitadel

A cloud-native, open-source identity and access management platform — OIDC, SAML, and passwordless auth with multi-tenancy built in, a self-hostable alternative to Auth0 and Okta.

Go

hardRead guide →

Head-to-heads in this category

SSOSep 2026

Authelia

vs

authentik

A tiny forward-auth gate vs. a full identity provider.

Read the verdict →

SSOSep 2026

authentik

vs

Keycloak

Modern and self-hoster-friendly vs. the enterprise standard.

Read the verdict →

SSOSep 2026

authentik

vs

Pocket ID

A full identity platform vs. a passkey-only sign-in box.

Read the verdict →

SSOSep 2026

authentik

vs

Tinyauth

A full identity platform vs. the tiniest possible login gate.

Read the verdict →

SSOSep 2026

authentik

vs

Zitadel

Two modern IdPs, built for different jobs.

Read the verdict →

SSOSep 2026

Keycloak

vs

Zitadel

The JVM incumbent vs. a modern, lighter Go alternative.

Read the verdict →