Open-source CIAM: what it is, and 6 platforms compared (2026)

CIAM stands for customer identity and access management: the identity layer your customers see, not the one your employees use. It covers registration, login, profile and consent, social and enterprise connections, and the branding around all of it. When people compare CIAM products, they are really comparing how well each one handles external users at scale without turning every new customer into a support ticket.

Open source changes the calculation. You can run CIAM on your own infrastructure, keep customer data in your own database, and avoid per-MAU pricing that grows with success. The trade-off is that you operate it, and you own the uptime and the compliance evidence.

What CIAM has to cover

Workforce IAM and CIAM share protocols, but not priorities. A customer-facing identity system needs:

What makes CIAM different from workforce IAM

• The users are outside your company. They can leave at any time, they sign up without an administrator, and they expect consumer-grade UX.
• The login page is part of the product. Branding, custom domains and localized copy are requirements, not nice-to-haves.
• The bill scales with users. Per-MAU pricing is common in CIAM and rare in workforce IAM, which is usually priced per employee.
• Abuse is part of the threat model. Credential stuffing, fake sign-ups and consent phishing are routine.
• Privacy rules apply. Consent, data export and deletion are product features, not back-office processes.

The six open-source options

Casdoor

Casdoor is an open-source IAM platform with hosted sign-in and sign-up pages you can brand per application: logo, theme, custom CSS and your own domain. It supports social login, passkeys, MFA, organizations, Casbin-based roles and permissions, and enterprise connections over OIDC and SAML. On the protocol side it is unusually broad: OAuth 2.0, OIDC, SAML, CAS, LDAP, RADIUS and SCIM.

For CIAM, the useful part is that customer-facing apps and internal tools share one identity provider, so a support console and a customer portal use the same users and roles. Casdoor Cloud is a dedicated instance from $6.67/month billed yearly, with no per-user or per-connection fees. The trade-off is a smaller community than Keycloak and no SOC 2 or ISO 27001 reports yet.

Keycloak

Keycloak is the most widely deployed open-source identity server and a CNCF incubating project. It speaks OIDC, OAuth 2.0 and SAML, brokers to other identity providers, and connects to LDAP and Active Directory. Its login themes are customizable, and its operational behavior is well understood by enterprise IT.

The trade-off is operational weight: it is a Java service that takes planning to upgrade and theme, and the project does not sell a managed service. For a CIAM workload with a small team, that matters.

Zitadel

Zitadel is built around multi-tenancy: organizations, projects and delegated administration for B2B SaaS. It offers a managed cloud with a free tier of 100 daily active users and a Pro plan at $100 per month.

Two caveats for CIAM: it is licensed under AGPL-3.0, which some legal teams will not accept for modified code, and its cloud is priced by daily active users rather than monthly.

Logto

Logto focuses on developer experience and a polished sign-in experience: many SDKs, organizations, RBAC and a clean admin console. Its cloud has a generous free tier of 50,000 MAU.

The trade-off is that RBAC, organizations, MFA, enterprise SSO and custom domains are paid add-ons in Logto Cloud, and it does not speak LDAP, CAS or RADIUS, so it will not replace an existing directory or campus SSO server.

Ory

Ory is a set of headless services: Kratos for identity, Hydra for OAuth 2.0 and OIDC, Keto for permissions and Oathkeeper as a proxy. It runs at very large scale and gives you complete control over the UI.

The cost is that you assemble and operate several services and build every screen yourself. Ory Network starts at $770 per year for production.

authentik

authentik is popular with homelabs and small IT teams. Its visual flows let you design login, enrollment and recovery steps, and its outposts add SSO in front of apps that have no login integration. It supports OIDC, SAML, LDAP and RADIUS.

The core is MIT, but some features live in an enterprise directory at $5 per internal user per month. There is no managed cloud from the authentik team.

What open source does not include

Open source gives you the software, not the service. Before choosing it for CIAM, decide who owns:

• Uptime. A customer login outage is a product outage. You need monitoring, backups and a rollback plan.
• Upgrades. Security patches have to land quickly, especially for a system that issues tokens.
• Compliance evidence. SOC 2, ISO 27001 and penetration-test reports are often procurement requirements. Most open-source projects do not publish them.
• Email deliverability. Password resets and verification emails need a real sending domain and reputation management.
• Support. When login breaks at 2 a.m., who answers?

A managed instance such as Casdoor Cloud moves several of these to the vendor while keeping the same open-source code underneath.

How to choose

• One platform for customers and employees, broad protocols, flat pricing: Casdoor.
• A large enterprise that already runs Java and Red Hat tooling: Keycloak.
• Multi-tenant B2B SaaS where each customer needs its own admin: Zitadel or Casdoor.
• A developer-first customer login with a generous free tier: Logto.
• Headless APIs and a fully custom UI: Ory.
• A small self-hosted setup with visual flows: authentik.

FAQ

Is CIAM different from IAM? CIAM is the customer-facing subset of IAM. IAM also covers employees, contractors and machine identities; CIAM focuses on external users, self-service, branding and consumer-scale abuse controls.

Is open-source CIAM really free? The software is free to self-host. Your costs are infrastructure, engineering time, security reviews and support. Managed options add a subscription but remove the operations work.

Can CIAM run on premises? Yes. Every project on this list can be self-hosted. Some regulated customers require it; others accept a dedicated cloud instance.

What is the difference between CIAM and SSO? SSO is a login experience: one session across several apps. CIAM is the broader customer identity system that includes registration, profile, consent, MFA and SSO.

If you want to try the first option without running anything, start a Casdoor Cloud trial, or self-host Casdoor with Docker in a few minutes.