This article is written by the team that builds Casdoor, so we are not neutral, and we say where we think Casdoor fits and where it doesn't. Facts about other products come from their own websites as of November 1, 2026 (listed under Sources) and may have changed. Spotted something out of date? Tell us.
"Free SAML identity provider" can mean two very different things:
- Free software you run yourself, with no user limit and no feature gates.
- A free tier of a managed service, usually capped by users or connections.
Both are legitimate, but the trade-offs are different. This article covers the options and the questions that decide whether "free" stays free.
Open source: free software, your operations
These are the projects you can download and run without paying a license fee.
| Project | License | SAML 2.0 | Notes |
|---|---|---|---|
| Casdoor | Apache-2.0 | Yes, IdP and SP | OIDC, SAML, CAS, SCIM, LDAP; managed cloud available |
| Keycloak | Apache-2.0 | Yes, IdP and SP | The largest ecosystem and the most operational weight |
| authentik | MIT (core) | Yes | Strong self-hosted application catalog |
| Zitadel | AGPL-3.0 | Yes | API-first, multi-tenant; check the AGPL obligations |
The software is free; the hosting is not. A production deployment needs a database, backups, upgrades, monitoring and someone on call. For a small team, that operating cost often exceeds the license fee of a managed service — which is why some open-source projects also sell a hosted version.
Casdoor
Casdoor is a SAML 2.0 identity provider and service provider, with a metadata URL per application, configurable attribute mapping, IdP-initiated SSO and single logout. Because it is Apache-2.0, there are no per-user or per-connection limits when self-hosted. The managed cloud starts at $9 per month if you do not want to run it.
Setup is documented step by step in set up Casdoor as a SAML IdP.
Keycloak
The reference implementation in the space. If you need every SAML flag and a large community, Keycloak is the safe answer. Budget for a Java service with its own database and a regular upgrade cycle.
Managed free tiers
If you would rather not operate anything, several services have free tiers that include SAML:
| Service | Free tier | SAML on the free tier |
|---|---|---|
| Auth0 | 25,000 MAU | 1 enterprise connection |
| Microsoft Entra External ID | 50,000 MAU / month | Yes |
| WorkOS AuthKit | Up to 1,000,000 MAU | No — SSO is billed per connection |
| Okta Workforce | No free tier | — |
The pattern to watch: free users, paid connections. A free tier can cover tens of thousands of users and still charge you per enterprise connection, which is the line item that matters if your customers each bring their own identity provider.
What to check before you commit
- SP-initiated and IdP-initiated flows. Some free tiers support one but not the other.
- Signed assertions and metadata. You need a signing certificate you can rotate.
- Attribute mapping. Email, name, groups and roles, with the variables or expressions to map them.
- Single logout. Whether it is supported, and in which direction.
- Limits. User caps, connection caps, and what happens when you exceed them.
- Export path. If you outgrow the free tier, how do users and configuration move?
- License obligations. AGPL and MPL are not the same as Apache-2.0 for a product you distribute.
The short version
If "free" means "no license fee and no user limit", the open-source projects are the answer: Casdoor or Keycloak for most teams, authentik if you want an application catalog, Zitadel if its model fits and AGPL is acceptable.
If "free" means "no operations", the managed free tiers work until you hit a connection limit — at which point per-connection pricing usually makes self-hosting or a flat-priced cloud the cheaper option.
Related reading: open-source identity servers and free identity providers compared.
Sources
- Casdoor docs: Casdoor as a SAML 2.0 identity provider
- Keycloak (Apache-2.0)
- authentik license (MIT core)
- Zitadel (AGPL-3.0)
- Auth0 pricing
- Microsoft Entra External ID pricing
- WorkOS pricing
- Casdoor pricing
Product names are trademarks of their respective owners.