Open-source JumpCloud alternatives

Authelia is an open-source authentication and authorization server that provides single sign-on and multi-factor authentication for web applications. It sits in front of your services, usually alongside a reverse proxy, so users sign in once at a portal and are checked against policies before reaching an app.

Supported factors and backends include TOTP, push notifications, two-factor methods and LDAP, according to its topics, and it is described as OpenID Certified and ready for post-quantum cryptography. It is written in Go and runs well as a small container, with documentation for Docker and Kubernetes deployments. Self-hosters often use it to add a consistent login and second factor to tools that have weak or no authentication of their own.

Authelia is licensed under Apache-2.0. As an authentication component, it is meant to be run on your own infrastructure, and it suits home labs, small organizations and teams wanting a lightweight identity layer without a heavier enterprise identity platform.

authentik is an open-source Identity Provider for modern single sign-on. It supports SAML, OAuth2 and OpenID Connect, LDAP, RADIUS and more, and is designed for self-hosting at any scale, from a small lab to production clusters. A reverse-proxy mode also lets it protect applications that lack native SSO support.

The project positions its enterprise offering as a way for organizations to replace incumbent identity providers (Okta, Auth0, Entra ID or Ping Identity) in large-scale identity management. For installation, Docker Compose is recommended for small and test setups, a Helm chart for Kubernetes suits larger setups, and official templates exist for AWS CloudFormation and a one-click DigitalOcean Marketplace app.

The codebase is mostly Python with Kubernetes tooling, and the license is listed as 'Other' on GitHub because it mixes open-source and enterprise components, so check which features fall under which terms. authentik is a common choice for self-hosters and companies who want to centralize logins across internal tools without paying per-user fees to a hosted identity vendor.

lldap is a lightweight authentication server that exposes an opinionated, simplified LDAP interface. It is aimed mostly at self-hosting setups where open-source components such as Nextcloud only support LDAP as an external authentication source, and where running a full directory server would be more work than needed.

It comes with a web frontend for managing users, and also lets users update their own details and reset a forgotten password via email. By default data is stored in SQLite, with MySQL, MariaDB or PostgreSQL as alternative backends. It integrates with services such as Keycloak, Authelia and Nextcloud, and for features like OAuth or OpenID support you can add components such as Keycloak or Authelia that use lldap as the source of truth for users.

The project is written in Rust, licensed under GPL-3.0 and uses the OPAQUE protocol. The README states plainly that it is not meant to be a full LDAP server and points to OpenLDAP for that. It installs from OCI images, Kubernetes, TrueNAS or distribution packages.

Kanidm is an identity management platform written in Rust. Other applications and services can offload authentication and identity storage to it, and the project aims to be a complete identity provider so that you should not need to add components such as Keycloak next to it.

It covers a broad set of protocols and features: OpenID Connect, LDAP, RADIUS, SCIM, WebAuthn passkeys and SSH key authentication, according to the repository topics. To keep it manageable, the design favors secure defaults, minimal configuration and components that repair themselves, so the same system can serve small home labs, families and small businesses as well as larger deployments.

Kanidm is licensed under MPL-2.0 and runs on your own servers, with documentation and a community around the project. It suits administrators who want a single, secure place to manage users, groups and logins for their services without operating a heavyweight identity stack.

Defguard is a self-hosted platform that brings WireGuard VPN, identity and access management, multi-factor authentication, and network access control into one product. It is built in Rust with a security-first design and targets organizations that otherwise juggle separate tools for identity, VPN access, and permissions. The core is open source under the AGPL, while some Enterprise components are open-code.

The VPN side supports multiple locations with per-location access control, MFA per connection, self-service device setup, and kernel and userspace WireGuard. The identity side includes an internal OIDC provider for single sign-on, external OIDC with Google, Microsoft, or custom providers, LDAP and Active Directory sync, remote enrollment, and user self-service. MFA options include TOTP, WebAuthn and FIDO2, and email tokens.

Everything runs in your own environment with no external dependencies or data leaving your infrastructure, and the project publishes SBOMs, penetration test reports, and architecture decision records. It suits IT and security teams that want zero-trust remote access and identity management they control, as an alternative to products such as Keycloak and Pritunl.

VoidAuth is an open-source SSO authentication and user management provider that sits in front of self-hosted applications. It is meant to be easy for administrators and end users, adding features such as passkeys, user invitations, self-registration, and email support. It runs in Docker and is released under the AGPL-3.0 license.

It acts as an OpenID Connect provider, supports proxy ForwardAuth for protecting apps behind a reverse proxy, and offers an LDAP directory server. Administrators manage users and groups from an admin panel, invite users or allow self-registration, and customize the logo, title, theme color, and email templates. Security options include multi-factor authentication, passkey-only accounts, and password resets verified by email.

Data is stored in Postgres or SQLite with encryption at rest. VoidAuth suits homelab users and small teams who run several services and want one login across them, as a lighter alternative to larger identity platforms.

FreeIPA lets Linux administrators centrally manage identity, authentication and access control for Linux and UNIX systems. It provides command-line and web-based management tools that are simple to install and use, and it focuses on ease of management and automation of installation and configuration. The repository is a mirror of the upstream project and is written mostly in Python.

The README lists benefits such as letting users access every machine with the same credentials and security settings, transparent access to personal files from any machine, grouping to restrict services and files to specific users, central management of passwords, SSH public keys, sudo rules, keytabs and access control rules, and delegation of selected administrative tasks to other power users.

FreeIPA bundles well-known open-source components with unified tools: an LDAP server based on the 389 project, a Kerberos KDC based on MIT Kerberos, a public key infrastructure based on Dogtag, Samba libraries for Active Directory integration and a DNS server based on BIND. It can integrate into Active Directory environments through cross-realm Kerberos trust or user synchronization. The code is licensed under GPL-3.0.