the open source movement

Replace Okta.

11 open source alternatives, ranked by health. We re-check every project weekly, so you don’t migrate to something abandoned.

Ranked by health

  1. KeycloakOpen Source Identity and Access Management For Modern Applications and Services★ 37k Apache-2.0 Java self-host
  2. AutheliaAuthentication and authorization server that adds single sign-on and multi-factor authentication to web apps.★ 29k Apache-2.0 Go self-host
  3. authentikIdentity provider supporting single sign-on via OAuth2/OpenID Connect, SAML, LDAP and proxy authentication.★ 26k MIT + commercial enterprise/ Python self-host
  4. ZITADELIdentity and access management platform with OpenID Connect, SAML, passkeys, multi-tenancy and audit logs.★ 15k AGPL-3.0 Go self-host managed
  5. CasdoorIdentity and access management server with a web UI supporting OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn and MFA.★ 15k Apache-2.0 Go self-host managed
  6. Ory KratosHeadless identity and user management server written in Go, with passkeys, social sign-in, MFA and account recovery.★ 14k Apache-2.0 Go self-host managed
  7. Apereo CASSingle sign-on server supporting the CAS, SAML, OAuth2 and OpenID Connect protocols.★ 11k Apache-2.0 Java self-host
  8. DexOpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors★ 11k Apache-2.0 Go self-host
  9. Pocket IDOpenID Connect provider that lets users sign in to self-hosted applications with passkeys.★ 9.3k BSD-2-Clause Go self-host
  10. TinyauthLightweight authentication server and OpenID Connect provider that adds login to apps behind a reverse proxy.★ 8.3k AGPL-3.0 Go self-host
  11. KanidmKanidm: A simple, secure, and fast identity management platform★ 5.4k MPL-2.0 Rust self-host
How the ranking works

Health blends commit recency, release cadence, issue throughput, contributor breadth and star growth. Stars are shown but never ranked on. The full method.