Open-source IBM Verify alternatives

Keycloak is an open-source identity and access management server. It lets application teams add authentication and secure services without building their own login system, since Keycloak handles storing users and authenticating them. The project is written in Java, released under the Apache-2.0 license and governed under the Cloud Native Computing Foundation code of conduct.

Keycloak supports standard protocols such as OpenID Connect and SAML, and offers user federation, strong authentication, user management and fine-grained authorization. You can run it from the downloadable distribution using a start-dev command, or use the official Docker image published on Quay for containers and Kubernetes setups. The project provides documentation, a user mailing list and community channels for help, along with guidance for building and testing from source.

Authelia is an open-source authentication and authorization server that provides single sign-on and multi-factor authentication for web applications. It sits in front of your services, usually alongside a reverse proxy, so users sign in once at a portal and are checked against policies before reaching an app.

Supported factors and backends include TOTP, push notifications, two-factor methods and LDAP, according to its topics, and it is described as OpenID Certified and ready for post-quantum cryptography. It is written in Go and runs well as a small container, with documentation for Docker and Kubernetes deployments. Self-hosters often use it to add a consistent login and second factor to tools that have weak or no authentication of their own.

Authelia is licensed under Apache-2.0. As an authentication component, it is meant to be run on your own infrastructure, and it suits home labs, small organizations and teams wanting a lightweight identity layer without a heavier enterprise identity platform.

authentik is an open-source Identity Provider for modern single sign-on. It supports SAML, OAuth2 and OpenID Connect, LDAP, RADIUS and more, and is designed for self-hosting at any scale, from a small lab to production clusters. A reverse-proxy mode also lets it protect applications that lack native SSO support.

The project positions its enterprise offering as a way for organizations to replace incumbent identity providers (Okta, Auth0, Entra ID or Ping Identity) in large-scale identity management. For installation, Docker Compose is recommended for small and test setups, a Helm chart for Kubernetes suits larger setups, and official templates exist for AWS CloudFormation and a one-click DigitalOcean Marketplace app.

The codebase is mostly Python with Kubernetes tooling, and the license is listed as 'Other' on GitHub because it mixes open-source and enterprise components, so check which features fall under which terms. authentik is a common choice for self-hosters and companies who want to centralize logins across internal tools without paying per-user fees to a hosted identity vendor.

ZITADEL is an identity and access management platform, open source, for teams that need more than basic login. It targets SaaS products, B2B platforms and self-hosted IAM stacks, and bundles single sign-on, multi-factor authentication, passkeys, OIDC, SAML and SCIM in an API-first design, with an emphasis on a mature multi-tenancy model.

A comparison table in the README sets it against FusionAuth, Keycloak and Auth0 or Okta on points such as open-source status, self-hosting, infrastructure-level tenants, native B2B organizations and a comprehensive event-stream audit trail. Topics list standards and features including OAuth 2, OpenID Connect, FIDO2, 2FA and passkeys. The positioning is that you can own the identity layer without vendor lock-in while still getting a polished product.

ZITADEL is written in Go and licensed under AGPL-3.0, with a website, chat, docs and blog. You can run it yourself or use the vendor's managed cloud. It suits developers and security teams building multi-tenant applications who want a self-hostable alternative to commercial identity providers.

Casdoor is a self-hosted identity and access management platform with a web console. It acts as a single sign-on and authentication server, so applications can delegate login to it instead of implementing their own user management, sessions and password handling.

Supported protocols include OIDC, OAuth 2.0, SAML 2.0, LDAP, CAS and SCIM 2.0, alongside WebAuthn, TOTP and MCP, and it can connect to identity providers such as Google Workspace, Microsoft Entra ID and GitHub. Sign-in options include passwords, email or SMS codes, WebAuthn and Face ID, plus any social providers you enable. The admin console covers users, tokens, organizations, providers and applications, and settings change without a redeploy or config file.

Casdoor is written in Go and licensed under Apache-2.0. A quick trial runs on SQLite with sample data and needs no separate database or config file. Its newer positioning emphasizes AI agents, with an MCP and agent gateway for LLM tooling, and hosted demo instances are available for trying it before installing.

This entry covers Apereo CAS, the Central Authentication Service. CAS is both an open and well-documented authentication protocol and the primary open-source Java server implementing it, which works as a multilingual, enterprise-grade identity provider and web single sign-on solution.

Beyond its own protocol, the server supports additional authentication protocols and features, including SAML2, OpenID Connect, OAuth2, LDAP authentication and multifactor authentication, with topics also referencing FIDO and Duo Security. It is built on Spring Boot, Spring Webflow and Spring Cloud, and aims to be a comprehensive platform for authentication and authorization needs.

Apereo CAS is licensed under Apache-2.0. The recommended way to deploy it is the WAR Overlay method, and cloning the full codebase is only needed if you want to contribute. Documentation, release notes, a maintenance policy and a release schedule are published by the project. It is typically adopted by universities and other organizations that need centralized login across many applications.

Kanidm is an identity management platform written in Rust. Other applications and services can offload authentication and identity storage to it, and the project aims to be a complete identity provider so that you should not need to add components such as Keycloak next to it.

It covers a broad set of protocols and features: OpenID Connect, LDAP, RADIUS, SCIM, WebAuthn passkeys and SSH key authentication, according to the repository topics. To keep it manageable, the design favors secure defaults, minimal configuration and components that repair themselves, so the same system can serve small home labs, families and small businesses as well as larger deployments.

Kanidm is licensed under MPL-2.0 and runs on your own servers, with documentation and a community around the project. It suits administrators who want a single, secure place to manage users, groups and logins for their services without operating a heavyweight identity stack.

MaxKey, from the Dromara community, is an IAM and IDaaS product written in Java and released under the Apache-2.0 license. It provides single sign-on, identity management, access management, RBAC-based permission control, and resource management. The name is a homophone of a phrase about a master key that unlocks enterprise security needs, according to the README.

It supports standard protocols including OAuth 2.x and OpenID Connect, SAML 2.0, CAS, JWT, and SCIM, and its topics also list LDAP, Active Directory, Kerberos, multi-factor authentication, TOTP, and multi-tenancy. Features focus on user lifecycle management and compliance, and the project presents itself as open, secure, and self-controlled. Documentation is in English and Chinese.

MaxKey is aimed at enterprises, particularly in Chinese-speaking markets, that need a self-hosted alternative to commercial identity platforms. Teams should confirm industry claims in the README against their own requirements.

privacyIDEA is an open-source authentication server that manages multi-factor authentication for an organization. It issues and verifies second factors such as one-time passwords, hardware tokens, push notifications and FIDO2 or WebAuthn security keys, so applications and servers can add two-factor login without each building its own token handling.

The server is written in Python and exposes an API that other systems can call to check a login attempt. Its topics point to support for OTP, passkeys, push authentication and certificates, and administrators enroll and manage tokens centrally rather than configuring every service by hand. The project documentation includes how-tos for running it behind Apache2 with MySQL and for protecting a whole server farm.

privacyIDEA is released under the AGPL-3.0 licence and can be self-hosted, which keeps token data and user policies on infrastructure you control. The project website also lists an Enterprise Edition next to the community version, along with a demo site, screenshots and community resources for anyone evaluating it.

FreeIPA lets Linux administrators centrally manage identity, authentication and access control for Linux and UNIX systems. It provides command-line and web-based management tools that are simple to install and use, and it focuses on ease of management and automation of installation and configuration. The repository is a mirror of the upstream project and is written mostly in Python.

The README lists benefits such as letting users access every machine with the same credentials and security settings, transparent access to personal files from any machine, grouping to restrict services and files to specific users, central management of passwords, SSH public keys, sudo rules, keytabs and access control rules, and delegation of selected administrative tasks to other power users.

FreeIPA bundles well-known open-source components with unified tools: an LDAP server based on the 389 project, a Kerberos KDC based on MIT Kerberos, a public key infrastructure based on Dogtag, Samba libraries for Active Directory integration and a DNS server based on BIND. It can integrate into Active Directory environments through cross-realm Kerberos trust or user synchronization. The code is licensed under GPL-3.0.