CyberArk Identity Security Platform

Best Self Hosted Alternatives to CyberArk Identity Security Platform

A curated collection of the 3 best self hosted alternatives to CyberArk Identity Security Platform.

Enterprise identity security platform providing privileged access management, secret/password vaulting, privileged session management, SSO and adaptive MFA, plus identity lifecycle, directory and federation services to secure human, machine and privileged accounts.

Alternatives List

#1
Teleport

Teleport

Secure access platform for servers, Kubernetes, databases, desktops, and web apps with SSO/MFA, short-lived certificates, and full session auditing.

Teleport screenshot

Teleport is an identity and access platform that provides secure connectivity, authentication, authorization, and auditing for infrastructure. It replaces long-lived SSH keys, static tokens, and traditional bastions/VPN approaches with an identity-aware access proxy and short-lived certificates.

Key Features

  • Single sign-on for infrastructure via OIDC and SAML integrations
  • Multi-factor authentication and support for modern authenticators (including FIDO2/WebAuthn)
  • Short-lived, certificate-based access for SSH, Kubernetes, databases, and other resource types
  • Role-based access control with support for fine-grained policies and just-in-time elevation workflows
  • Session recording and audit trails across SSH, Kubernetes, database, RDP, and web application access
  • Secure tunneling to reach resources behind NATs and firewalls without exposing inbound ports
  • Web UI and CLI for resource discovery, access, and operational visibility

Use Cases

  • Centralize secure admin access to servers, clusters, and databases without distributing keys
  • Provide audited access to sensitive environments (production, regulated systems) with MFA and approvals
  • Enable secure remote access to internal web apps and desktops for support and operations teams

Limitations and Considerations

  • Full functionality spans multiple protocols and resource types, which can increase deployment and policy complexity in larger environments

Teleport is well-suited for teams that need a unified access layer across diverse infrastructure and want consistent identity-based controls. Its combination of SSO/MFA, short-lived credentials, and detailed auditing helps reduce risk while improving operational access workflows.

19.7kstars
2kforks
View Details
#2
Warpgate

Warpgate

Self-hosted transparent bastion host and PAM for SSH, HTTPS, MySQL and Postgres with RBAC, session recording, and SSO/2FA—no client-side software required.

Warpgate screenshot

Warpgate is a transparent bastion host and privileged access management (PAM) service for securing access to internal SSH, HTTPS, MySQL, and PostgreSQL targets. It authenticates users, forwards connections directly to the target service without client wrappers, and provides auditing through an admin web UI.

Key Features

  • Native listeners for SSH, HTTPS, MySQL, and PostgreSQL, with transparent forwarding to target services
  • Role-based access control (RBAC) with precise user-to-service assignments
  • Session recording with live view and replay for auditing
  • Built-in admin web UI to manage users, targets, access, and session history
  • SSO and 2FA support, including OpenID Connect and TOTP
  • Single-binary deployment with minimal operational dependencies

Use Cases

  • Secure controlled access to production servers and databases without VPNs or jump host configuration
  • Audited contractor or third-party access with session replay and command-level visibility
  • Acting as a proxy entrypoint for internal HTTPS services (including developer tooling endpoints)

Limitations and Considerations

  • Default session history storage uses SQLite, which may not fit all scaling/HA requirements

Warpgate is suited for teams that need strong access controls, auditability, and SSO-backed authentication for infrastructure services while keeping client connections fully standard. It is particularly useful when you want bastion-like security without broad network access exposure.

6.4kstars
224forks
View Details
#3
Engity's Bifröst

Engity's Bifröst

Advanced SSH server and bastion that authenticates via OpenID Connect or keys, runs sessions inside Docker containers or Kubernetes pods, and supports automatic user provisioning.

Engity's Bifröst screenshot

Bifröst is an advanced, SSH-protocol-compliant server designed as a modern bastion/jump host. It supports traditional public-key SSH authentication and OpenID Connect/OAuth2 identity providers, and can execute user sessions directly inside Docker containers or Kubernetes pods for isolated, ephemeral environments.

Key Features

  • Full SSH protocol compatibility while supporting OpenID Connect/OAuth2 authentication alongside SSH keys
  • Execute user sessions inside per-user Docker containers or directly inside Kubernetes pods
  • Automatic user provisioning and cleanup based on configurable templates and idle timeouts
  • "Remember me" behavior to temporarily cache provided public keys for faster reconnects during an active session
  • Configurable execution environments with custom images, networks, and resource constraints
  • Designed to replace OpenSSH as a bastion while integrating SSO identity providers for centralized access control

Use Cases

  • Provide SSO-backed SSH access for developers, operators, or contractors without additional client tooling
  • Offer ephemeral, isolated shells for diagnostics or support by launching users into containerized environments
  • Grant direct access to a Kubernetes cluster by entering dedicated pods without port-forwarding or kubectl proxies

Limitations and Considerations

  • Project is under active development; configuration model and CLI/API structure are reported as evolving and may change
  • Not all enterprise features (advanced RBAC, extensive audit integrations) may be production-ready depending on deployment needs

Bifröst is suitable for teams that need SSO-integrated SSH access and ephemeral container/pod sessions. It combines SSH compatibility with modern identity and container orchestration workflows for streamlined, centrally-managed access.

73stars
1forks
View Details

Why choose an open source alternative?

  • •Data ownership: Keep your data on your own servers
  • •No vendor lock-in: Freedom to switch or modify at any time
  • •Cost savings: Reduce or eliminate subscription fees
  • •Transparency: Audit the code and know exactly what's running