Gluu, the company behind an open-source identity and access management server, writes about authentication, OAuth/SAML/OpenID Connect, and API security.
HN commenters mention Gluu as one self-hostable open-source option for authentication alongside Keycloak, with one considering it for LDAP, OpenID and RADIUS support.
Personally I think of Authelia and Keratin as really good projects in the don't-build-auth-into-your-apps-ever-again space. If auth isn't already built into your app gateway/mesh/proxy, then these services might be something worth dropping alongside.
A few more projects in this space:
- Keycloak (you won't get fired for picking this)[0]
- CloudFoundry's UAA[1]
- Gluu [2]
- ORY (Hydra + friends)[3]
- Keratin [4]
- OpenUnison [5]
- Dex[6]
- Netlify's GoTrue[7]
All of these solutions are a bit different but here are some of the axes:
- Whether or not they function as an OAuth provider
- Whether they're centered around application-user-login via mechanisms like email/password, application auth, or SSO
- Whether or not they serve as a proxy to another down-the-line OAuth provider (Dex, GoTrue)
- GUI availability
- F/OSS-ness (basically all of them have very permissive licenses)
[EDIT] More entries for this list in another comment @ https://news.ycombinator.com/item?id=26411457
[0]: https://www.keycloak.org/
[1]: https://github.com/cloudfoundry/uaa
[2]: https://gluu.org/docs/gluu-server/4.2/
[3]: https://github.com/ory/hydra#what-is-ory-hydra
[4]: https://keratin.github.io/authn-server/
[5]: https://github.com/tremolosecurity/openunison
[6]: https://github.com/dexidp/dex
[7]: https://github.com/netlify/gotrue
I've been considering setting up a Gluu [1] instance for some of my services. It supposedly supports LDAP as well as OpenID and Oauth2 for authentication as well as RADIUS. From what I can tell, this would fit your use case perfectly fine. It's available as open source software but the company behind it is selling it as well in case you'd like a support contract.
Note that I haven't set it up myself yet, it's still on my ever-growing list of "tools I have to take a good look at sometime in the future". It does seem like a very good piece of software though.
[1] https://www.gluu.org/
This introduction is pretty simple and concise to just understand what it is: https://www.cloudflare.com/learning/access-management/what-is-oauth/
Follow that up with this SAML and OAuth comparison: https://www.ubisecure.com/uncategorized/difference-between-saml-and-oauth/
Then see how OpenID Connect fits in: https://www.okta.com/identity-101/whats-the-difference-between-oauth-openid-connect-and-saml/ https://www.gluu.org/blog/oauth-vs-saml-vs-openid-connect/
And this page shows examples of a web app using OAuth2: https://connect2id.com/learn/oauth-2
On the open-source authN/authZ front, I am aware of a few different projects. Would love feedback from anyone who has used or evaluated these (or others).
Edit: These tools can be self-hosted and integrated to provide out-of-the-box auth functionality to your application.
* The ORY ecosystem of tools [1]
* Gluu [2]
* Keycloak [3]
[1]: https://www.ory.sh/docs/next/ecosystem/overview
[2]: https://www.gluu.org
[3]: https://www.keycloak.org
My partner Mike Schwartz founded Gluu because he was tired of recommending proprietary access management platforms like Siteminder and IBM Tivoli that were locked behind six figure licenses.
We're now a team of about 30 people with 10 years of development into the Gluu Server, a free open source software platform for SSO, 2FA, access management:
https://gluu.org/docs/ce
We don't have definite plans to build a full-featured IDP, but we did build a Mock IDP we use in CI, QA and demos that could possibly be a starting point for your purposes? Other OSS IDPs include Keycloak and Gluu Server if you wanted to check those out!
https://github.com/enterprise-oss/sinatra-ruby-idp
https://www.keycloak.org/
https://www.gluu.org/