Roundups of open-source identity platforms, secrets managers, directories and identity governance tools, each comparing the main self-hosted options.
Keycloak, Zitadel and authentik side by side, with Ory, WSO2 Identity Server and Authelia named where they fit: protocols, multi-tenancy, admin experience, licenses and the paid enterprise features of each.
OpenBao, HashiCorp Vault and Infisical compared for self-hosted secrets management: license status after Vault's BSL change, dynamic secrets, Kubernetes integration, PKI and what is gated behind paid editions.
FreeIPA, Samba AD and OpenLDAP compared as self-hosted directories: Active Directory compatibility, Kerberos, DNS, replication, client support and licensing.
midPoint and Apache Syncope compared for identity governance and administration (provisioning, reconciliation, access requests), with Keycloak named as the access management layer both are typically paired with.
Self-hosted team password managers compared: Bitwarden, Vaultwarden and Passbolt on license and paid features, encryption model, SSO and directory sync, databases and support, with a verdict by team size and compliance need.
Open-source PAM and bastion options compared: Teleport, JumpServer and Apache Guacamole on protocols, recording, approvals, SSO, licensing limits of the free editions and high availability, with a verdict by environment.
Self-hosted zero trust network access compared: NetBird, Headscale and OpenZiti on architecture, clients, identity provider integration, access policies and operating effort; Pomerium is covered for web-only access.
Putting SSO in front of apps that have none: Pomerium, Authelia and OAuth2 Proxy compared on who authenticates users, supported reverse proxies, policies, MFA, session storage and licensing, with a verdict by setup.
Self-hosted customer identity for SaaS and apps: Zitadel, Ory and Logto compared on tenant model, hosted login versus headless APIs, SAML and SCIM, licensing and managed options; Keycloak and Casdoor are named for context.
Single sign-on for kubectl and cluster tools: Dex, Keycloak and authentik compared on OIDC for the Kubernetes API server, connectors to upstream providers, refresh tokens, user storage and operating effort inside the cluster.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.