Open-source OneLogin alternatives

Keycloak is an open-source identity and access management server. It lets application teams add authentication and secure services without building their own login system, since Keycloak handles storing users and authenticating them. The project is written in Java, released under the Apache-2.0 license and governed under the Cloud Native Computing Foundation code of conduct.

Keycloak supports standard protocols such as OpenID Connect and SAML, and offers user federation, strong authentication, user management and fine-grained authorization. You can run it from the downloadable distribution using a start-dev command, or use the official Docker image published on Quay for containers and Kubernetes setups. The project provides documentation, a user mailing list and community channels for help, along with guidance for building and testing from source.

Authelia is an open-source authentication and authorization server that provides single sign-on and multi-factor authentication for web applications. It sits in front of your services, usually alongside a reverse proxy, so users sign in once at a portal and are checked against policies before reaching an app.

Supported factors and backends include TOTP, push notifications, two-factor methods and LDAP, according to its topics, and it is described as OpenID Certified and ready for post-quantum cryptography. It is written in Go and runs well as a small container, with documentation for Docker and Kubernetes deployments. Self-hosters often use it to add a consistent login and second factor to tools that have weak or no authentication of their own.

Authelia is licensed under Apache-2.0. As an authentication component, it is meant to be run on your own infrastructure, and it suits home labs, small organizations and teams wanting a lightweight identity layer without a heavier enterprise identity platform.

authentik is an open-source Identity Provider for modern single sign-on. It supports SAML, OAuth2 and OpenID Connect, LDAP, RADIUS and more, and is designed for self-hosting at any scale, from a small lab to production clusters. A reverse-proxy mode also lets it protect applications that lack native SSO support.

The project positions its enterprise offering as a way for organizations to replace incumbent identity providers (Okta, Auth0, Entra ID or Ping Identity) in large-scale identity management. For installation, Docker Compose is recommended for small and test setups, a Helm chart for Kubernetes suits larger setups, and official templates exist for AWS CloudFormation and a one-click DigitalOcean Marketplace app.

The codebase is mostly Python with Kubernetes tooling, and the license is listed as 'Other' on GitHub because it mixes open-source and enterprise components, so check which features fall under which terms. authentik is a common choice for self-hosters and companies who want to centralize logins across internal tools without paying per-user fees to a hosted identity vendor.

Casdoor is a self-hosted identity and access management platform with a web console. It acts as a single sign-on and authentication server, so applications can delegate login to it instead of implementing their own user management, sessions and password handling.

Supported protocols include OIDC, OAuth 2.0, SAML 2.0, LDAP, CAS and SCIM 2.0, alongside WebAuthn, TOTP and MCP, and it can connect to identity providers such as Google Workspace, Microsoft Entra ID and GitHub. Sign-in options include passwords, email or SMS codes, WebAuthn and Face ID, plus any social providers you enable. The admin console covers users, tokens, organizations, providers and applications, and settings change without a redeploy or config file.

Casdoor is written in Go and licensed under Apache-2.0. A quick trial runs on SQLite with sample data and needs no separate database or config file. Its newer positioning emphasizes AI agents, with an MCP and agent gateway for LLM tooling, and hosted demo instances are available for trying it before installing.

This entry covers Apereo CAS, the Central Authentication Service. CAS is both an open and well-documented authentication protocol and the primary open-source Java server implementing it, which works as a multilingual, enterprise-grade identity provider and web single sign-on solution.

Beyond its own protocol, the server supports additional authentication protocols and features, including SAML2, OpenID Connect, OAuth2, LDAP authentication and multifactor authentication, with topics also referencing FIDO and Duo Security. It is built on Spring Boot, Spring Webflow and Spring Cloud, and aims to be a comprehensive platform for authentication and authorization needs.

Apereo CAS is licensed under Apache-2.0. The recommended way to deploy it is the WAR Overlay method, and cloning the full codebase is only needed if you want to contribute. Documentation, release notes, a maintenance policy and a release schedule are published by the project. It is typically adopted by universities and other organizations that need centralized login across many applications.

VoidAuth is an open-source SSO authentication and user management provider that sits in front of self-hosted applications. It is meant to be easy for administrators and end users, adding features such as passkeys, user invitations, self-registration, and email support. It runs in Docker and is released under the AGPL-3.0 license.

It acts as an OpenID Connect provider, supports proxy ForwardAuth for protecting apps behind a reverse proxy, and offers an LDAP directory server. Administrators manage users and groups from an admin panel, invite users or allow self-registration, and customize the logo, title, theme color, and email templates. Security options include multi-factor authentication, passkey-only accounts, and password resets verified by email.

Data is stored in Postgres or SQLite with encryption at rest. VoidAuth suits homelab users and small teams who run several services and want one login across them, as a lighter alternative to larger identity platforms.

MaxKey, from the Dromara community, is an IAM and IDaaS product written in Java and released under the Apache-2.0 license. It provides single sign-on, identity management, access management, RBAC-based permission control, and resource management. The name is a homophone of a phrase about a master key that unlocks enterprise security needs, according to the README.

It supports standard protocols including OAuth 2.x and OpenID Connect, SAML 2.0, CAS, JWT, and SCIM, and its topics also list LDAP, Active Directory, Kerberos, multi-factor authentication, TOTP, and multi-tenancy. Features focus on user lifecycle management and compliance, and the project presents itself as open, secure, and self-controlled. Documentation is in English and Chinese.

MaxKey is aimed at enterprises, particularly in Chinese-speaking markets, that need a self-hosted alternative to commercial identity platforms. Teams should confirm industry claims in the README against their own requirements.

Rauthy is an identity and access management server written in Rust. It acts as a single sign-on identity provider supporting OpenID Connect, OAuth 2 and PAM, and it aims to be simple to set up and run while keeping secure defaults. The project received an independent security audit as part of its funding, and the findings were addressed in a later release.

It puts heavy emphasis on passkeys and strong security, with FIDO2 and WebAuthn login options, MFA and passwordless flows. Defaults include ed25519 token signing and S256 PKCE for new OIDC clients, though these can be relaxed for older systems. Other features include high availability, client branding, UI translation, an admin UI, events and auditing, SCIM, and support for IoT and headless CLI tools.

By default Rauthy runs on top of Hiqlite, so it needs no external database, with Postgres available as an alternative. It is licensed under Apache-2.0, can run on modest hardware, and is self-hosted. Its topics reference Keycloak as the kind of software it can replace, so it suits small teams and homelabs that want a compact SSO server.

SimpleSAMLphp is an application written in native PHP that deals with authentication. Its main focus is SAML 2.0, where it can act either as a service provider that protects a web application or as an identity provider that authenticates users, which makes it common in universities and organizations using federated login.

It also supports other identity protocols and frameworks including CAS, OpenID Connect, WS-Federation and OAuth, and it is easy to extend with custom modules. The project site offers downloads, documentation, security announcements, modules and support, and the community-led project publishes regular releases, with security releases announced on its mailing list in advance.

SimpleSAMLphp is licensed under LGPL-2.1 and installed on your own PHP web server, so it is self-hosted. The project is run by a board and community of contributors. It suits developers and identity administrators who need to connect PHP applications to a SAML federation or run a lightweight identity provider.

OpenAM, from the Open Identity Platform community, is an access management solution that covers authentication, single sign-on, authorization, federation, entitlements and web services security. It is meant for organizations that want to own and protect their users' digital identities rather than hand them to an outside provider.

Cross-domain single sign-on, SAML 2.0, OAuth 2.0 and OpenID Connect let it integrate with legacy, custom and cloud applications without changing them. Authentication can combine methods such as password, OTP, saved cookie and QR, and third-party identity providers can be used through SAML, OAuth2, NTLM and Kerberos. Policies can be role-, attribute- or authentication-level-based and can be scripted, using OpenIG or the OpenAM Policy Agent.

OpenAM's pluggable architecture allows custom authentication modules, user data sources, session data sources and post-authentication logic. It is written in Java and licensed under the Common Development and Distribution License; distribution packages are available for download. Because it is software you deploy yourself, you run and operate it on your own infrastructure.