SHSelfHostIndex

Open Policy Agent vs Shibboleth Identity Provider

A side-by-side comparison of two self-hosted identity & sso options — licensing, setup difficulty, resource needs, and what each one replaces.

Not the right match-up?
OP Open Policy Agent General-purpose policy engine for cloud-native stacks VS SH Shibboleth Identity Provider Standards-based SAML identity provider for federations
FeatureOpen Policy AgentShibboleth Identity Provider
CategoryIdentity & SSOIdentity & SSO
LicenseApache-2.0Apache-2.0
LanguageGoJava
Setup difficultyMediumHard
Min. RAM256 MB1,024 MB
Deploymentdocker, kubernetes, binarybare-metal, docker, source
GitHub stars★ 12,086★ 200
First released20162003
ReplacesAWS IAM policiesOkta, Ping Identity

Why pick each one

Choose Open Policy Agent if…

  • Released under the Apache-2.0 license
  • First-class Docker support for quick deployment
  • Kubernetes-ready with Helm charts available
  • Mature project with 12.1k GitHub stars
Open Policy Agent details

Choose Shibboleth Identity Provider if…

  • Gold standard for SAML federations
  • Highly configurable
Shibboleth Identity Provider details

Frequently asked questions

Is Open Policy Agent or Shibboleth Identity Provider better?

Open Policy Agent is the stronger all-round pick: it has both the larger community and the simpler medium setup. Consider Shibboleth Identity Provider if its specific feature set fits your needs better.

Are Open Policy Agent and Shibboleth Identity Provider free and open-source?

Yes. Open Policy Agent is licensed under Apache-2.0 and Shibboleth Identity Provider under Apache-2.0. Both can be self-hosted at no software cost.

Can I run Open Policy Agent and Shibboleth Identity Provider with Docker?

Open Policy Agent: yes. Shibboleth Identity Provider: yes.

Related comparisons