Pocket ID
Identity & SSOSimple OIDC provider that uses only passkeys
Replaces Auth0, Authelia
Easiest Identity & SSO to self-host
7 identity & sso apps that are easy to get running, ranked by verified deploy effort, project health, and popularity. 2 have a verified ≈5-minute Docker setup.
Univention Corporate Server
Identity & SSOIntegrated identity and infrastructure management platform
Replaces Microsoft Active Directory
LLDAP
Identity & SSOLightweight LDAP server with a simple web interface
Replaces Active Directory, OpenLDAP
2FAuth
Identity & SSOSelf-hosted web app to manage two-factor authentication codes
Replaces Authy, Google Authenticator
Authorizer
Identity & SSOOpen-source auth solution with a ready-made UI
Replaces Auth0, Firebase Authentication
GLAuth
Identity & SSOLightweight LDAP server for developers and small setups
Replaces Microsoft Active Directory, OpenLDAP
Traefik Forward Auth
Identity & SSOMinimal forward authentication service for Traefik
Replaces Cloudflare Access
No apps match these filters.
The shortlist at a glance
| App | Deploy effort | Difficulty | Min. RAM | License | ★ Stars |
|---|---|---|---|---|---|
| Pocket ID | ≈5-minute setup | Easy | 128 MB | BSD-2-Clause | 9,579 |
| Univention Corporate Server | ≈5-minute setup | Hard | 2,048 MB | AGPL-3.0 | 309 |
| LLDAP | Under-an-hour setup | Easy | 64 MB | GPL-3.0 | 6,564 |
| 2FAuth | Under-an-hour setup | Easy | 256 MB | AGPL-3.0 | 4,177 |
| Authorizer | Under-an-hour setup | Easy | 256 MB | Apache-2.0 | 2,111 |
| GLAuth | Under-an-hour setup | Easy | 64 MB | MIT | 2,857 |
| Traefik Forward Auth | Under-an-hour setup | Easy | 64 MB | MIT | 2,391 |
Last reviewed Oct 11, 2026 · 684 words
Pocket ID is the easiest identity server to self-host and the one I would hand a beginner. It is a single container with a verified ≈5-minute badge, the directory estimates 128 MB of RAM, and it does one job: an OpenID Connect provider where every login is a passkey, so there are no passwords to store, reset, or leak. If the apps you want behind single sign-on speak OIDC, Pocket ID gets you there in an evening.
Read the ranking with one correction
Univention Corporate Server sits second because it ships one-click platform packages, but the directory rates it Hard and estimates 2 GB: it is an Active Directory-compatible domain controller and management platform, not a first install. Skip it unless you are replacing a Windows domain.
The rest of the list is parts, not providers, and knowing which part does what saves a confused weekend:
| Pick | What it does | RAM estimate | Where it fits |
|---|---|---|---|
| Pocket ID | OIDC login with passkeys | 128 MB | Your SSO provider |
| LLDAP | Small LDAP directory with a web UI | 64 MB | User list for apps that only speak LDAP |
| GLAuth | Config-file LDAP server | 64 MB | Same job, edited as a file |
| Traefik Forward Auth | Login gate in front of Traefik routes | 64 MB | Apps with no login of their own |
| Authorizer | Auth API with a prebuilt login UI | 256 MB | Building your own app |
| 2FAuth | Web vault for TOTP codes | 256 MB | Not SSO; replaces an authenticator app |
LLDAP is the natural second install: many self-hosted apps accept LDAP before they accept OIDC, and LLDAP gives you one place to add a family member. The GLAuth vs LLDAP comparison covers the web-UI versus config-file choice.
What "easy" still leaves you to do
HTTPS is mandatory, not optional. Browsers only allow passkeys on secure origins, so Pocket ID needs a real domain and a certificate from a reverse proxy before anyone can register. Persistence matters more here than anywhere else in your homelab: if the identity server's data volume disappears, every app behind it locks you out at once, so back that volume up and test a restore before you move a second app onto it. Plan account recovery too. With passkeys only, a lost phone is a lost login, so register at least two passkeys per person, one on a phone and one on a hardware key or laptop.
Then do the per-app work, which is where the hours actually go. Each app needs a client ID, a secret, and a redirect URL registered in Pocket ID and pasted into its own settings. Apps with no OIDC support need a forward-auth layer at the proxy instead, which is what the reverse proxy and auth stack is built around.
How much RAM does self-hosted SSO need?
Pocket ID plus LLDAP is under 256 MB combined by the directory's estimates, and adding Traefik Forward Auth keeps it there. That fits beside everything else on a Raspberry Pi. The heavyweights are a different budget: authentik is estimated at 1 GB, and Keycloak at 1 GB before it does anything useful.
When should a beginner move past Pocket ID?
Step up when someone in your user base cannot or will not use passkeys, when a legacy app demands SAML, or when you need to put a login screen in front of many apps that have no auth of their own. For the first two, ZITADEL (Medium, 512 MB) is the buyer's guide pick and the Pocket ID vs ZITADEL comparison maps the jump. For the third, the forward-auth tools Authelia and authentik are compared in Authentik vs Authelia.
What I'd do
Pocket ID behind HTTPS, two passkeys per person, a nightly backup of its volume, and LLDAP added the first time an app asks for LDAP. Wire up one OIDC app at a time and confirm each login works before moving to the next.