Tag

oidc

Tools in this catalog tagged oidc. Honest Catch, not a roundup.

9 tools · the Catch, not a ranking

LogtoMPL-2.0 identity platform with a 50k-MAU free Cloud
Cloud Free is for starting out. Passkeys, hiding branding, orgs, MFA, and enterprise SSO live as Pro add-ons. MPL-2.0 is file-level copyleft, not MIT.
KeycloakApache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP
CNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.
DexApache-2.0 federated OIDC IdP that owns no user state
Protocol adapter, not a user directory and not a proxy gate. Distinct from Authelia (reverse-proxy SSO) and from authentik/ZITADEL/Keycloak (they store users). Dex owns no user state. You still need an upstream IdP.
KanidmMPL-2.0 Rust IdP aiming to replace needing Keycloak
Rust IdP aiming to replace needing Keycloak — not the Java CNCF suite. Distinct from Keycloak (Apache-2.0 JVM IAM). You still operate the box.
CasdoorApache-2.0 UI-first IdP; Hosted Free 25k MAU, self-host primary
UI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.
Ory Open SourceApache-2.0 modular Go IAM: Kratos, Hydra, Keto, Oathkeeper
Vs Keycloak: modular Go you compose, not one Java IAM. LOUD: Ory own compare table still labels Ory Open Source Evaluation and prototyping; FAQ steers prototypes to OSS and scale to OEL/Network — print that. Ory Cloud/Network CUT as the free path. Not a Dex/Keycloak/Casdoor twin if the Catch stays modular-compose.
Pocket IDBSD-2-Clause passkey-only OIDC IdP; self-host only
Vs Hanko/Authelia/Keycloak/Ory: passkey-ONLY OIDC IdP (no passwords). Homelab/MCP-scoped, not enterprise IAM. Free path is self-host only.
TinyauthAGPL-3.0 one-binary proxy auth + Certified OIDC
Vs Authelia/Pocket ID: tiny proxy-fronted auth + Certified OIDC in one binary — not Authelia reverse-proxy SSO alone, not passkeys-only Pocket ID. Free path is self-host.
FusionAuthSource-available CIAM; Community self-host free unlimited users
LOUD: NOT open source — source-available proprietary CE. Vs Keycloak/ZITADEL/Ory: easier admin UX + flat pricing, but you cannot fork freely like Apache/AGPL IdPs. Premium features and FusionAuth Cloud are paid. Ops burden is yours on CE.