Skip to content

Best SSO Identity & SSO for self-hosting

The 28 best SSO identity & sso you can self-host, ranked by community traction.

Keycloak

Open-source identity and access management for modern apps

Replaces Okta, Auth0

★ 37.3k Hard setup Apache-2.0

Ory Hydra

Certified OAuth 2.0 and OpenID Connect server

Replaces Okta, Auth0

★ 17.6k Hard setup Apache-2.0

ZITADEL

Cloud-native identity infrastructure with multi-tenancy built

Replaces Auth0, Okta

★ 15.3k Medium setup Apache-2.0

Logto

Developer-friendly authentication and authorization platform

Replaces Auth0, Firebase Auth

★ 14.7k Medium setup MPL-2.0

Casdoor

UI-first identity and access management with SSO support

Replaces Auth0, Okta

★ 14.6k Medium setup Apache-2.0

Ory Kratos

Headless identity and user management API server

Replaces Auth0, Firebase Auth

★ 13.9k Hard setup Apache-2.0

Apereo CAS

Enterprise single sign-on server for web applications

Replaces Okta, Ping Identity

★ 11.4k Hard setup Apache-2.0

Dex

OpenID Connect identity provider with pluggable connectors

Replaces Okta, Auth0

★ 11.2k Medium setup Apache-2.0

Pocket ID

Simple OIDC provider that uses only passkeys

Replaces Auth0, Authelia

★ 9.6k Easy setup BSD-2-Clause

Kanidm

Modern, simple and secure identity management server

Replaces Active Directory, Okta

★ 5.5k Medium setup MPL-2.0

node-oidc-provider

Certified OpenID Connect and OAuth 2.0 provider for Node.js

Replaces Auth0, Okta

★ 3.8k Hard setup MIT

Ory Oathkeeper

Identity and access proxy for zero-trust networks

Replaces Cloudflare Access

★ 3.6k Medium setup Apache-2.0

Vouch Proxy

SSO authentication helper for reverse proxies

Replaces Okta Access Gateway

★ 3.3k Medium setup MIT

SAML Jackson

SAML and OIDC SSO service bridging enterprise providers

Replaces Auth0, WorkOS

★ 2.3k Medium setup Apache-2.0

Caddy Security

Authentication and authorization plugin for Caddy

Replaces Cloudflare Access

★ 2.3k Medium setup Apache-2.0

Rauthy

Lightweight OpenID Connect provider written in Rust

Replaces Keycloak, Auth0

★ 1.4k Medium setup Apache-2.0

FreeIPA

Integrated identity management for Linux and Unix environments

Replaces Active Directory

★ 1.3k Hard setup GPL-3.0

SimpleSAMLphp

PHP implementation of SAML and identity federation

Replaces Okta, PingFederate

★ 1.1k Medium setup LGPL-2.1

WSO2 Identity Server

Open-source identity and access management server

Replaces Okta, ForgeRock

★ 884 Hard setup Apache-2.0

Janssen Project

Cloud-native identity and access management platform

Replaces Okta, Auth0

★ 652 Hard setup Apache-2.0

Apache Syncope

Open-source system for managing digital identities

Replaces SailPoint, Okta

★ 343 Hard setup Apache-2.0

FusionAuth

Complete authentication and authorization platform

Replaces Auth0, Okta

★ 241 Medium setup Apache-2.0

Shibboleth Identity Provider

Standards-based SAML identity provider for federations

Replaces Okta, Ping Identity

★ 200 Hard setup Apache-2.0

OpenUnison

Identity management and SSO portal for Kubernetes

Replaces Okta

★ 137 Hard setup Apache-2.0

LemonLDAP::NG

Web single sign-on and access management system

Replaces Okta, PingFederate

★ 84 Hard setup GPL-2.0

Ipsilon

Identity provider for federated single sign-on

Replaces Okta, PingFederate

★ 80 Hard setup GPL-3.0

Gluu Flex

Enterprise identity and access management platform

Replaces Okta, Ping Identity

★ 31 Hard setup Apache-2.0

Hello Identity Coop

Open-source authentication broker for passwordless login

Replaces Auth0, Firebase Auth

★ 7 Medium setup MIT

At a glance

App	Deploy effort	Difficulty	Min. RAM	License	★ Stars
Keycloak	Under-an-hour setup	Hard	1,024 MB	Apache-2.0	37,335
Ory Hydra	Under-an-hour setup	Hard	256 MB	Apache-2.0	17,607
ZITADEL	Under-an-hour setup	Medium	512 MB	Apache-2.0	15,305
Logto	Under-an-hour setup	Medium	512 MB	MPL-2.0	14,676
Casdoor	Under-an-hour setup	Medium	256 MB	Apache-2.0	14,562
Ory Kratos	Under-an-hour setup	Hard	256 MB	Apache-2.0	13,921
Apereo CAS	Under-an-hour setup	Hard	1,024 MB	Apache-2.0	11,387
Dex	Under-an-hour setup	Medium	128 MB	Apache-2.0	11,187
Pocket ID	≈5-minute setup	Easy	128 MB	BSD-2-Clause	9,579
Kanidm	Under-an-hour setup	Medium	256 MB	MPL-2.0	5,462

Quick picks

Most adopted: Keycloak (37,335 GitHub stars).
Lightest footprint: Vouch Proxy (from 64 MB RAM, against 4,096 MB for the heaviest here).
Fastest to deploy: Pocket ID (verified single-container compose).
Licensing: 18 of 28 use Apache-2.0; check the rest individually if you plan to modify and redistribute.

Every option here is open-source and self-hostable, tagged SSO within the identity & sso category. Deploy effort is graded from published container recipes, not vendor claims — see the methodology.

Keep exploring

All Identity & SSO Easiest Identity & SSO to self-host How to choose identity provider: the Identity & SSO buyer's guide

Head-to-head: SSO identity & sso