Self-hosted identity management and authentication platforms providing secure user login and access control for applications.
Kratos is a centralized identity and access management server designed to handle user registration, authentication, and profile management. It functions as an identity flow orchestrator, managing the state and security of authentication processes across web, mobile, and command-line interfaces. The system provides a standards-compliant authorization server that issues tokens and manages delegated access for third-party applications and internal services, supporting multi-factor authentication and custom identity schemas to secure user accounts. The project distinguishes itself through a headl
Kratos is a comprehensive, self-hostable identity and access management server that provides robust authentication, multi-factor support, and flexible authorization flows through a headless, API-first architecture.
Authelia is a centralized identity and access management server designed to secure web applications through unified authentication and authorization. It functions as an identity authority that enables single sign-on across diverse platforms, allowing users to access multiple services with a single set of credentials. By acting as a standards-compliant provider, it facilitates secure identity propagation and token issuance for client applications. The platform distinguishes itself through its ability to integrate directly with web gateways as a reverse proxy authentication middleware, intercep
Authelia is a comprehensive, self-hostable identity and access management server that provides robust authentication, multi-factor support, and granular access control, making it a perfect fit for your requirements.
django-allauth is a comprehensive authentication framework for Django applications that manages user registration, account ownership verification, and secure login processes. It provides a system for handling the entire user account lifecycle, including the ability to define custom signup fields and implement identity verification. The project distinguishes itself by providing a suite of OAuth and SAML integrations for social account authentication and the capability to act as an OpenID Connect identity provider. It further supports decoupled architectures through a token-based headless authe
This is a comprehensive authentication framework for Django that provides OIDC, OAuth2, and MFA capabilities, though it functions as a library to be integrated into your application rather than a standalone, platform-agnostic IAM server.
Pig is a microservice-based RBAC permission management platform built on Spring Cloud and Spring Boot, with OAuth2 authentication and authorization at its core. It provides a dedicated authorization server that issues access and refresh tokens using authorization code, password, and refresh token grant types, while embedding role and permission checks into each microservice to secure API endpoints. The platform distinguishes itself through a comprehensive set of integrated capabilities, including automatic CRUD code generation from database schemas that produces controller, service, mapper, a
Pig is a microservice-based platform that includes a dedicated OAuth2 authorization server and centralized role-based access control, making it a functional choice for managing identity and permissions within a self-hosted environment.
Casdoor is a centralized identity and access management platform that functions as an OAuth 2.0 authorization server. It provides a comprehensive suite of services for managing user identities, authentication sessions, and access policies across both web and machine-to-machine applications. Built with a decoupled frontend-backend architecture in Go, the platform supports high-concurrency environments and offers a web-based management interface for administrative tasks. The platform distinguishes itself through its extensive support for federated identity management, allowing integration with
Casdoor is a self-hostable identity and access management platform that natively supports OIDC, OAuth2, MFA, and role-based access control, making it a comprehensive solution for your authentication and authorization needs.
SuperTokens Core is an open-source, self-hosted authentication and identity management platform designed for deployment within private infrastructure. It provides a comprehensive suite for managing user accounts, roles, and secure authentication flows, utilizing a modular, recipe-based architecture that allows developers to enable specific security features without modifying the core codebase. The platform distinguishes itself through its robust multi-tenancy capabilities, which allow for the logical or physical isolation of user records and configuration settings across different organizatio
SuperTokens Core is a self-hostable identity and access management platform that provides OIDC/OAuth2 support, MFA, role-based access control, and a comprehensive dashboard for managing user authentication and authorization.
Hanko is an open-source identity provider and customer identity and access management system. It serves as a passkey authentication service and an OAuth and SAML SSO gateway, allowing applications to authenticate users and issue tokens via standard identity protocols. The project distinguishes itself through a strong focus on passwordless access using WebAuthn-based passkeys and email-based passcodes. It provides framework-agnostic authentication interfaces as customizable web components that can be embedded directly into web applications to handle login, registration, and profile management.
Hanko is a comprehensive, self-hostable identity and access management platform that provides OIDC/OAuth2 support, MFA, and robust user management, making it a direct fit for your requirements.
Tinyauth is an authentication middleware service and identity provider that verifies user identities to grant system access. It operates as a standalone server or as an authentication gateway, utilizing a reverse proxy model to intercept requests and validate credentials before traffic reaches protected backend services. The project functions as an OpenID Connect provider for single sign-on experiences and an OAuth 2.0 gateway that delegates verification to external providers such as Google and GitHub. It also acts as an LDAP authentication server, allowing for centralized user management and
Tinyauth is a self-hostable identity provider and authentication gateway that supports OIDC, OAuth2, and MFA, making it a functional IAM server for securing backend services.
Dex is an OpenID Connect provider and identity federation proxy that translates authentication signals from various upstream sources into a unified OpenID Connect interface. It functions as a multi-protocol identity broker, enabling client applications to implement a single standard while delegating user verification to external identity providers. The project distinguishes itself through a pluggable connector architecture that bridges disparate protocols including LDAP, SAML, and OAuth2. It provides specific integrations for services such as GitHub, Google, GitLab, and Microsoft, while offer
Dex is a self-hostable identity broker that provides OIDC and OAuth2 authentication services, though it functions primarily as a federation proxy rather than a full-featured IAM suite with a built-in user management dashboard.
Hydra is a headless identity server that functions as a certified OAuth2 and OpenID Connect provider. It is designed as an authentication engine that manages authorization handshakes and token lifecycles while remaining decoupled from the user interface. The project distinguishes itself through a headless architecture, allowing external management of login and consent flows. It provides specialized capabilities for dynamic client registration, JSON Web Token issuance, and a system for rotating encryption secrets without service downtime. The system covers a broad range of identity operations
This is a specialized OAuth2 and OIDC provider that handles the core authorization and token lifecycle, though it requires integration with a separate user management system because it is intentionally headless and lacks a built-in user dashboard.
OpenAuth is a standards-based authentication server and identity provider that implements OAuth 2.0 and OpenID Connect protocols. It serves as a centralized system for managing user identities, issuing access tokens, and orchestrating authentication flows across various services. The project functions as a federated identity gateway, aggregating external providers such as Google, GitHub, Microsoft, Apple, and Discord into a unified login flow. It distinguishes itself with a multi-tenant architecture that supports pluggable identity providers and customizable user interface frameworks for bran
OpenAuth is a standards-based identity provider that supports OIDC, OAuth2, and social logins, making it a capable self-hostable solution for managing authentication and authorization flows.
Keycloak is an open-source identity and access management server that provides a centralized platform for user authentication, authorization, and identity federation. It functions as a standards-compliant identity provider, utilizing a centralized engine to validate credentials and issue cryptographically signed tokens based on industry-standard protocols like OpenID Connect and SAML. This enables organizations to secure diverse applications and services through a unified authentication layer. The platform distinguishes itself through its cloud-native orchestration and high-availability capab
Keycloak is a comprehensive, self-hostable identity and access management server that natively supports OIDC, OAuth2, MFA, and robust role-based access control, making it a flagship solution for centralized authentication.
Appwrite is a backend-as-a-service platform that provides a unified development environment for building full-stack applications. It integrates essential infrastructure components—including authentication, databases, storage, and serverless functions—into a single, centralized interface to simplify application development and resource management. The platform distinguishes itself through a container-based microservices architecture that ensures consistent execution across diverse infrastructure. It features a versatile connectivity layer that links frontend applications with third-party servi
Appwrite is a comprehensive backend-as-a-service platform that includes a robust, self-hostable authentication and authorization engine supporting OIDC, OAuth2, MFA, and role-based access control, making it a viable solution for your IAM needs despite its broader scope.
OpenCloud is a self-hosted platform for synchronizing files across devices and sharing them with team members through collaborative spaces and access controls. It enables users to sync files between a server and local desktop and mobile clients, manage files and folders, and share content with internal and external contributors via permission-based links and file drops. The platform integrates an embedded OpenID Connect identity provider for authentication and supports external identity providers. It stores all data and metadata directly on the filesystem, eliminating the need for a separate
This is a file synchronization and collaboration platform rather than a dedicated identity and access management server, even though it includes an embedded OpenID Connect provider for its own internal authentication needs.
JustAuth is an OAuth 2.0 authentication library designed to integrate multiple third-party login providers into a single interface. It abstracts various social login APIs and identity services, allowing applications to manage authentication using the OAuth 2.0 and OIDC protocols. The project provides a multi-provider identity integrator that replaces the need for individual vendor software development kits. It includes a toolkit for defining custom authentication platforms and proprietary identity services by specifying custom OAuth protocols and endpoints. The library manages the full authe
This is an authentication integration library for developers to embed in their own applications, rather than a standalone identity and access management server that provides user management and role-based access control.