6 free and open-source SAML identity providers

A SAML identity provider (IdP) is the server that signs users in and sends signed assertions to the apps (service providers) that trust it. You need one when SaaS tools such as AWS, Google Workspace, Salesforce, Slack or GitLab should accept your company's logins, or when your own B2B app has to support SAML SSO in testing.

Commercial IdPs (Okta, Entra ID, Google) charge per user or bundle SAML into larger suites. The six below are free to self-host. All of them are real SAML 2.0 IdPs with metadata, signed assertions and attribute mapping, but they differ a lot in what else they do and how much work they take to run.

At a glance

1. Casdoor

Casdoor is a single Go binary with a web admin console. Each application can act as a SAML 2.0 IdP: Casdoor publishes metadata, signs assertions with the application's certificate, maps user attributes and supports single logout. The same users also sign in over OIDC, CAS, LDAP and RADIUS, so one server covers SaaS apps, your own apps, VPNs and older software.

It ships with sign-up and login pages, MFA (authenticator apps, SMS and email codes), passkeys, social login and syncers that import users from Active Directory, Entra ID, Google Workspace, Okta or Keycloak. If you'd rather not run it, Casdoor Cloud is a dedicated instance from $24/month billed yearly ($29 month to month).

Trade-offs: a smaller community than Keycloak, and Casdoor Cloud doesn't have SOC 2 or ISO 27001 reports yet. See the SAML page for setup guides.

2. Keycloak

Keycloak is the default open-source answer: a CNCF project backed by Red Hat, with mature SAML and OIDC support, identity brokering and user federation from LDAP and Active Directory.

Trade-offs: it's a Java service with a large configuration surface, upgrades take planning, and there is no managed service from the project. See Casdoor vs Keycloak and Keycloak alternatives.

3. authentik

authentik is popular with self-hosters. Its SAML provider supports IdP- and SP-initiated logins, and login flows are designed visually. Outposts add LDAP, RADIUS and proxy authentication for apps that can't do SSO.

Trade-offs: no hosted version, and enterprise features are licensed per user. See Casdoor vs authentik.

4. Zitadel

Zitadel is a Go identity platform designed for multi-tenant B2B SaaS, with organizations and delegated administration built in. It can act as a SAML IdP for your applications alongside OIDC.

Trade-offs: AGPL-3.0 since version 3, which some companies' legal teams avoid, and Zitadel Cloud is priced by daily active users. See Casdoor vs Zitadel.

5. Shibboleth Identity Provider

Shibboleth is the IdP of the academic world: most research and education federations, such as InCommon and eduGAIN, were built around it. It has the deepest SAML feature set on this list, including federation metadata handling and fine-grained attribute release policies.

Trade-offs: it's a Java web application configured through XML files, with no admin console, and it expects an existing directory (usually LDAP or Active Directory) for users. Choose it if you're joining an academic federation; for anything else it's a lot of machinery.

6. SimpleSAMLphp

SimpleSAMLphp is a PHP library and application that can act as both SAML SP and IdP. It authenticates users against a configurable source, such as LDAP, a database or a static list, which also makes it a handy test IdP when you're adding SAML to your own app.

Trade-offs: configuration is in PHP files, there's no user management, sign-up or MFA of its own, and you deploy and patch it like any PHP application.

How to choose

• You want one IdP for SaaS apps, your own apps and network devices, and an easy way out of running it: Casdoor.
• You have Java expertise and want the most widely deployed option: Keycloak.
• You're self-hosting for a homelab or small team and like visual flows: authentik.
• You're building multi-tenant B2B SaaS and AGPL is fine: Zitadel.
• You're a university joining a SAML federation: Shibboleth.
• You just need a SAML IdP to test your app against: SimpleSAMLphp, or a free Casdoor instance in Docker.

FAQ

Is there a free SAML IdP I don't have to host? Most hosted IdPs offer a free developer tier, but SAML is often limited to paid plans. The free route is to self-host one of the options above.

Can I use one IdP for both SAML and OIDC apps? Yes. Casdoor, Keycloak, authentik and Zitadel all serve both from the same user accounts. Read SAML vs OIDC for when to use which.

What do I need to connect a SaaS app over SAML? Usually the IdP's metadata URL (or its SSO URL, entity ID and signing certificate) on the SaaS side, and the app's ACS URL and entity ID on the IdP side, plus an attribute mapping for email and name.