Objective

A single identity provider for every internal service — SAML / OIDC / LDAP, MFA, groups, policies, and self-service flows under one consistent UI.

Open Source Alternatives

Authentik (OSS) — 9 / 10

The best modern self-hosted IdP today. Powerful policy/flow engine, correct OIDC/SAML implementations, and a current, well-designed UI. Younger than Keycloak; certification surface is shallower. The clear OSS pick for greenfield platforms.

Keycloak — 8 / 10

Battle-tested OSS IdP, Red Hat-backed. Deepest enterprise certifications (FIPS, federation protocols, fine-grained access patterns). Dated UX, heavier to operate, slower release cadence. Still the safe enterprise pick.

Zitadel (OSS) — 8 / 10

Cloud-native multi-tenant IdP. Well-architected, modern, growing community. Smaller ecosystem than Authentik or Keycloak; deserves a serious look for new platforms.

Ory (Kratos / Hydra / Keto) — 7 / 10

OSS identity primitives, library/service split. Lower-level building blocks rather than a turnkey IdP. Right when you want to assemble your own; wrong when you want a product.

Pocket ID — 6 / 10

Minimalist OSS IdP, passkey-first. Lean and fast. Too limited for a platform with diverse protocol needs.

Casdoor — 6 / 10

Multi-protocol OSS IdP. Smaller ecosystem, less momentum than the top OSS picks.

Managed SaaS Alternatives

Auth0 — 9 / 10

Managed identity SaaS, premium tier. Excellent dev experience, broad integration coverage. Premium pricing; mostly a non-starter for self-hosted-first platforms.

Okta — 9 / 10

Enterprise SaaS IdP. Ubiquitous in larger orgs, deep enterprise feature set. Premium pricing and SaaS-locked.

Authentik Enterprise — 9 / 10

Commercial Authentik with support, SLAs, and enterprise features. Same technical excellence as OSS.

Zitadel Cloud — 8 / 10

Managed Zitadel. Multi-tenant by design; competitive pricing.

WorkOS — 8 / 10

Enterprise SSO/SCIM-as-a-service for B2B SaaS. Different audience (you’re providing SSO to your customers) — adjacent category.

Microsoft Entra ID (Azure AD) — 9 / 10

The Microsoft identity platform. Default for organisations on Microsoft 365 / Azure; deep federation features.

Google Workspace SSO — 7 / 10

Google’s identity platform. Best when the org is on Workspace; weaker as a standalone IdP for non-Google apps.

Scoring summary

Top in this category

Top OSS pick: Authentik. Top managed pick: Auth0 or Okta (depending on dev vs enterprise focus).

For modern self-hosted IdP, Authentik is the top pick. Keycloak still wins where enterprise certification depth is mandatory. This stack’s pick is the top of its specific subcategory.