SHSelfHostIndex

Identity & SSO

Centralize logins with self-hosted identity providers, SSO, and authentication services.

59 self-hosted apps · 336 comparisons

All identity & sso apps

Last reviewed Aug 26, 2026 · 453 words

Self-hosted identity is two shopping trips that share a shelf. One buyer wants single sign-on across the services they run; the other is building an application and needs login, sessions, and permissions as components. Every tool in this category serves one of those buyers, and the most expensive mistake here is deploying Keycloak when you needed neither.

How to choose an identity provider

Start by separating complete providers from parts. Keycloak, ZITADEL, Casdoor, and Logto are full identity providers: login pages, admin consoles, and OpenID Connect endpoints out of the box. Ory Kratos and Ory Hydra are deliberately headless — Kratos handles registration, recovery, and MFA through an API and expects you to build every screen; Hydra only issues OAuth tokens and manages no users at all. Casbin and Open Policy Agent are not identity software in the login sense: they answer "may this user do X" and assume something else already authenticated the user.

Then weigh operational cost. Keycloak is Java, wants 1 GB before it does anything useful, and earns its Hard difficulty rating; it repays that with 12 years of production hardening, LDAP and Active Directory federation, and support for every protocol you will ever meet. ZITADEL, Casdoor, and Logto each run in 256-512 MB of Go or TypeScript. Finally, check protocols: if a legacy app demands SAML, your shortlist is Keycloak, ZITADEL, Casdoor, or Apereo CAS; if everything speaks OIDC, all the modern options qualify.

Where to start

Keycloak (36,000 GitHub stars, Red Hat-backed, released 2014) is the pick when failure is not an option and enterprise directory federation is in scope — accept the learning curve. ZITADEL is the modern middle path: multi-tenancy as a first-class concept, passwordless and FIDO2 login, and an event-sourced audit trail that records every change, in half of Keycloak's footprint. Logto is for the developer building a product: prebuilt sign-in flows and SDKs for most frameworks give it the closest feel to a self-hosted Auth0.

A homelab may need less than an IdP

If the actual goal is one login box in front of a dozen Docker apps — most of which have no real auth of their own — a lighter SSO layer that integrates with your reverse proxy is the usual answer, and the standard pairing is compared in Authentik vs Authelia. A full enterprise IdP behind that setup is optional, not required.

Default for a first identity server: ZITADEL. It covers OIDC and SAML, runs in 512 MB, and grows from a homelab to a multi-tenant product without a migration. Reach for Keycloak only when a specific enterprise requirement forces your hand.

Curated picks

Easiest Identity & SSO to self-hostBest API Identity & SSOBest Docker Identity & SSOBest Free Identity & SSOBest Kubernetes Identity & SSOBest LDAP Identity & SSOBest Lightweight Identity & SSOBest Multi-User Identity & SSOBest OAuth Identity & SSOBest PostgreSQL Identity & SSOBest SSO Identity & SSO

Identity & SSO comparisons

336 head-to-head comparisons in this category.

See all comparisons →