Top 5 open-source WorkOS alternatives for enterprise SSO and SCIM

WorkOS sells the features enterprise customers ask B2B SaaS companies for: SAML and OIDC single sign-on with each customer's identity provider, SCIM directory sync, audit logs, and an admin portal where the customer's IT team sets it up. Its AuthKit login is free up to a million MAU. The enterprise features are priced per connection:

• SSO and Directory Sync are $125 per connection each for the first 15, falling to $65 at 51 to 100 connections.
• A custom domain is $99 per month; audit log streaming is $125 per month per SIEM connection.

So every enterprise customer adds a line to the bill. The alternatives below are open source and don't charge per connection.

At a glance

1. Casdoor

Casdoor covers what you'd buy from WorkOS and the login around it. Each customer is an organization with its own users, roles and admins, its own SAML or OIDC identity providers (Okta, Entra ID, ADFS, Google Workspace or any other), and SCIM provisioning into Casdoor. You can restrict a provider to the customer's email domains, so their employees are routed to their own IdP. Every action is recorded, and webhooks send events to your systems.

Your app connects to Casdoor once over OIDC and gets the same tokens whatever IdP the customer uses. Connections are included: Casdoor Cloud is a dedicated instance from $24/month billed yearly ($29 month to month) however many customers you onboard, and self-hosting is free.

Trade-offs: there's no equivalent of WorkOS's hosted Admin Portal where your customer's IT team configures SSO themselves; an admin of that organization sets it up in Casdoor's console. See Casdoor vs WorkOS.

2. Ory Polis

Ory Polis, formerly BoxyHQ Jackson, is the closest open-source match to WorkOS's SSO API: an Apache-2.0 service that bridges your customers' SAML connections to OIDC for your app and handles SCIM directory sync. It runs self-hosted or in Ory's cloud.

Trade-offs: it's only the enterprise piece. You still need user management, login pages and sessions elsewhere.

3. Keycloak

Keycloak can broker logins from any number of SAML and OIDC identity providers, and each realm is a separate tenant.

Trade-offs: each customer's realm or identity provider is more configuration to manage, there's no managed service from the project, and customer self-service SSO setup is up to you. See Casdoor vs Keycloak.

4. Zitadel

Zitadel is designed for B2B SaaS: organizations with delegated administration and their own identity providers. Zitadel Cloud is free for 100 daily active users; Pro is $100 per month with 25,000.

Trade-offs: AGPL-3.0, and the cloud is priced by daily active users. See Casdoor vs Zitadel.

5. Logto

Logto has organizations and enterprise SSO connectors with a polished console.

Trade-offs: in Logto Cloud, enterprise SSO and organizations are paid add-ons. See Casdoor vs Logto.

Which one should you choose?

• You want login, organizations, enterprise SSO and SCIM in one service, without per-connection fees: Casdoor.
• You already have login and only need the SAML and SCIM piece: Ory Polis.
• You already run Keycloak: add identity providers per realm.
• You want a B2B-focused cloud and AGPL-3.0 is fine: Zitadel.
• You want a per-MAU cloud with a large free tier: Logto.

To move from WorkOS, recreate each customer's SSO and directory connection as an identity provider in their Casdoor organization, import users, and switch your app to Casdoor's OIDC endpoints. Talk to us if you'd like help.