Member-only story
Top 10 Self-Hosted Identity and SSO Tools
Hi everyone, welcome back. Today, I will be going over self-hosted identity and single sign-on tools — ten projects that either hold your users and issue tokens, or sit in front of an app and force a login.
If you are newer to this, here is the distinction that makes the category click. There are two jobs, and almost every confusing conversation about SSO comes from mashing them together. The first belongs to the identity provider, or IdP: it stores accounts, checks passwords or passkeys, enforces multi-factor authentication, and issues a signed token saying who you are and what groups you belong to. The second belongs to an enforcer — a reverse proxy that stands in front of an application, sees you have no session, bounces you to the IdP, and only then lets the request through. An IdP without an enforcer cannot protect an app with no login code. An enforcer without an IdP has nobody to ask. Some tools here are providers, some enforcers, a couple both.
Single sign-on means you authenticate once with the provider and every connected application accepts that result instead of asking again. Those applications are service providers in SAML and relying parties in OpenID Connect; both mean the thing trusting the token. OAuth 2.0 is an authorization framework about delegating access to a resource, which is why “log in with OAuth” is a sloppy phrase beginners repeat constantly. OAuth alone never tells you who the user is. OpenID Connect, or OIDC, is a thin authentication layer on top of OAuth 2.0 that adds an ID token — a…
