Open-source RSA alternatives

Keycloak is an open-source identity and access management server. It lets application teams add authentication and secure services without building their own login system, since Keycloak handles storing users and authenticating them. The project is written in Java, released under the Apache-2.0 license and governed under the Cloud Native Computing Foundation code of conduct.

Keycloak supports standard protocols such as OpenID Connect and SAML, and offers user federation, strong authentication, user management and fine-grained authorization. You can run it from the downloadable distribution using a start-dev command, or use the official Docker image published on Quay for containers and Kubernetes setups. The project provides documentation, a user mailing list and community channels for help, along with guidance for building and testing from source.

Authelia is an open-source authentication and authorization server that provides single sign-on and multi-factor authentication for web applications. It sits in front of your services, usually alongside a reverse proxy, so users sign in once at a portal and are checked against policies before reaching an app.

Supported factors and backends include TOTP, push notifications, two-factor methods and LDAP, according to its topics, and it is described as OpenID Certified and ready for post-quantum cryptography. It is written in Go and runs well as a small container, with documentation for Docker and Kubernetes deployments. Self-hosters often use it to add a consistent login and second factor to tools that have weak or no authentication of their own.

Authelia is licensed under Apache-2.0. As an authentication component, it is meant to be run on your own infrastructure, and it suits home labs, small organizations and teams wanting a lightweight identity layer without a heavier enterprise identity platform.

authentik is an open-source Identity Provider for modern single sign-on. It supports SAML, OAuth2 and OpenID Connect, LDAP, RADIUS and more, and is designed for self-hosting at any scale, from a small lab to production clusters. A reverse-proxy mode also lets it protect applications that lack native SSO support.

The project positions its enterprise offering as a way for organizations to replace incumbent identity providers (Okta, Auth0, Entra ID or Ping Identity) in large-scale identity management. For installation, Docker Compose is recommended for small and test setups, a Helm chart for Kubernetes suits larger setups, and official templates exist for AWS CloudFormation and a one-click DigitalOcean Marketplace app.

The codebase is mostly Python with Kubernetes tooling, and the license is listed as 'Other' on GitHub because it mixes open-source and enterprise components, so check which features fall under which terms. authentik is a common choice for self-hosters and companies who want to centralize logins across internal tools without paying per-user fees to a hosted identity vendor.

privacyIDEA is an open-source authentication server that manages multi-factor authentication for an organization. It issues and verifies second factors such as one-time passwords, hardware tokens, push notifications and FIDO2 or WebAuthn security keys, so applications and servers can add two-factor login without each building its own token handling.

The server is written in Python and exposes an API that other systems can call to check a login attempt. Its topics point to support for OTP, passkeys, push authentication and certificates, and administrators enroll and manage tokens centrally rather than configuring every service by hand. The project documentation includes how-tos for running it behind Apache2 with MySQL and for protecting a whole server farm.

privacyIDEA is released under the AGPL-3.0 licence and can be self-hosted, which keeps token data and user policies on infrastructure you control. The project website also lists an Enterprise Edition next to the community version, along with a demo site, screenshots and community resources for anyone evaluating it.

OpenAM, from the Open Identity Platform community, is an access management solution that covers authentication, single sign-on, authorization, federation, entitlements and web services security. It is meant for organizations that want to own and protect their users' digital identities rather than hand them to an outside provider.

Cross-domain single sign-on, SAML 2.0, OAuth 2.0 and OpenID Connect let it integrate with legacy, custom and cloud applications without changing them. Authentication can combine methods such as password, OTP, saved cookie and QR, and third-party identity providers can be used through SAML, OAuth2, NTLM and Kerberos. Policies can be role-, attribute- or authentication-level-based and can be scripted, using OpenIG or the OpenAM Policy Agent.

OpenAM's pluggable architecture allows custom authentication modules, user data sources, session data sources and post-authentication logic. It is written in Java and licensed under the Common Development and Distribution License; distribution packages are available for download. Because it is software you deploy yourself, you run and operate it on your own infrastructure.

WSO2 Identity Server is an identity and access management solution that organizations can run on premises or in their own cloud environment. It is meant to secure applications for external consumers, an internal workforce, business customers and partners, and API access.

Standards support includes OAuth 2.0, OpenID Connect and SAML 2.0, with single sign-on, multi-factor and adaptive authentication. Recent versions add a visual designer for authentication flows, templates for configuring apps and login methods, simplified role-based access control for API policies, and a new authentication API for in-app login. AI-assisted features can generate flows from natural language descriptions and match branding. B2B capabilities include delegated administration and per-customer login options.

The code is Java and Apache-2.0 licensed. For teams that prefer not to operate it, WSO2 points to Asgardeo, a public identity cloud service built on the same technology core, which it says can be tried free of charge.