Open-source identity servers: the realistic shortlist

An identity server is the system that holds user accounts and issues the tokens or assertions applications use to sign people in. When it is open source, you can run it yourself, keep the data in your own network, and change what you need.

The category has more options than it had five years ago, and they are not interchangeable. This article covers what an identity server does, which projects are worth a look, and what "open source" does and does not save you.

What an identity server does

At a minimum:

• Stores users, credentials and profile data.
• Authenticates users with passwords, passkeys, MFA or upstream providers.
• Speaks the protocols applications need: OpenID Connect, SAML 2.0, sometimes CAS.
• Issues tokens and assertions that applications can verify.
• Exposes an admin API and console for user and application management.

Beyond the minimum, most production deployments need social login, enterprise federation per customer, SCIM provisioning, audit logs, multi-tenancy and session management.

The shortlist

Licenses matter: AGPL-3.0 (Zitadel) has obligations a company may not want if it modifies and distributes the software, and MPL-2.0 (Logto) is file-level copyleft. Apache-2.0 and MIT are the permissive options most enterprises prefer.

Keycloak

The reference open-source identity server. It has the largest ecosystem, the longest track record and integrations for almost everything. It is also the heaviest to operate: a Java service with its own database schema, a regular upgrade cadence and a configuration model that rewards experience.

Choose it when you need maximum protocol coverage, a large community and you have platform engineers to run it.

Casdoor

Casdoor is Apache-2.0 and covers OIDC, SAML 2.0, CAS, SCIM and LDAP, plus 75+ social providers, MFA and passkeys. It is lighter than Keycloak to deploy (a Go binary and a database), and it has a managed cloud from $9 per month with unlimited MAU if you would rather not operate it.

Choose it when you want the protocols without a Java stack, or when the per-user pricing of commercial CIAM is the problem.

authentik

authentik's core is MIT-licensed, with an enterprise directory under a separate license. It covers OIDC, SAML, LDAP and RADIUS, and it is popular for homelab and self-hosted application estates because of its proxy and application catalog features.

Choose it when you want a self-hosted identity provider with strong "connect my apps" ergonomics.

Zitadel

Zitadel is AGPL-3.0 and focuses on multi-tenancy and a modern API-first design. Its cloud free tier is measured in daily active users (100), which is much smaller than MAU-based allowances elsewhere.

Choose it when its multi-tenant model fits and the AGPL license is acceptable.

Ory and Logto

Ory splits identity (Kratos), OAuth 2.0 (Hydra) and permissions (Keto) into separate services; it is powerful and modular, and you assemble the pieces. Logto is MPL-2.0 and positioned as a developer-friendly CIAM product with a managed cloud.

Both are reasonable, but they are different shapes: Ory is infrastructure you compose, Logto is a product you adopt.

What self-hosting actually costs

The software is free; the operation is not. A production deployment needs:

• A database with backups and a tested restore.
• Upgrades, including schema migrations and security patches.
• High availability if sign-in downtime is unacceptable (it usually is).
• Monitoring for failed logins, certificate expiry and latency.
• Someone on call when the identity provider is down.

For a small team, that is the real difference between self-hosted and managed. The flat $9/month cloud option exists because many teams would rather not trade engineering time for a license fee.

How to choose

1. List the protocols you must support — including what your largest customer's identity provider speaks. SAML is usually non-negotiable in B2B.
2. Check the license against your distribution model.
3. Estimate operating cost, not just license cost: who upgrades it, who is on call.
4. Run a proof of concept with a real application and a real upstream IdP, not a demo.
5. Decide managed or self-hosted per environment — many teams self-host staging and use managed production, or the reverse.

Related reading: authentication platform checklist and keycloak alternatives.

Casdoor is open source and self-hostable, with a hosted option from $9 per month and no per-user fees.