20 self-hosted OneLogin alternatives

Keycloak is an open-source IAM server providing single sign-on, user federation, and centralized authentication and authorization using OIDC, OAuth 2.0, and SAML.

36.4k stars8.9k forksApache-2.0last commit 26 Aug 2026Actively maintained

Authelia is an open-source IAM and authentication server providing SSO, MFA, and access control for web apps, with OpenID Connect/OAuth 2.0 and reverse-proxy integration.

28.7k stars1.5k forksApache-2.0last commit 26 Aug 2026Actively maintained

Open-source IdP delivering SSO, OAuth2/OIDC, SAML2, LDAP, RADIUS, MFA, WebAuthn, conditional access and application-proxy capabilities for self-hosted deployments.

25.2k stars2k forkslast commit 27 Aug 2026Actively maintained

OAuth2 Proxy is a reverse proxy and middleware that protects web apps with OAuth2/OIDC login and forwards authenticated user identity to upstream services.

14.9k stars2.2k forksMITlast commit 24 Aug 2026Actively maintained

ZITADEL is an open source IAM/CIAM platform providing SSO, MFA, OIDC/OAuth2, SAML, user management, and multi-tenant organizations with audit logging.

14.9k stars1.3k forksAGPL-3.0last commit 26 Aug 2026Actively maintained

Open-source authentication and authorization infrastructure with OIDC/OAuth 2.1, SAML SSO, multi-tenancy, MFA, and RBAC for SaaS and AI apps.

14.5k stars1.2k forksMPL-2.0last commit 27 Aug 2026Actively maintained

Casdoor is an open-source, UI-first IAM/SSO platform supporting OAuth 2.0, OIDC, SAML, LDAP, SCIM, WebAuthn and MFA, with an admin web UI and SDKs.

14.3k stars1.8k forksApache-2.0last commit 25 Aug 2026Actively maintained

Pocket ID is a simple self-hosted OpenID Connect (OIDC) provider that lets users sign in to apps using passkeys instead of passwords.

9k stars304 forksBSD-2-Clauselast commit 26 Aug 2026Actively maintained

Tinyauth is a lightweight auth middleware that adds a login screen, OAuth, or LDAP authentication in front of your apps via common reverse proxies.

8.2k stars264 forksAGPL-3.0last commit 25 Aug 2026Actively maintained

Cosmos Cloud is a security-focused self-hosting platform that provides an app store, reverse proxy with automatic HTTPS, SSO/MFA, container management, backups, and monitoring.

6.1k stars250 forkslast commit 26 Aug 2026Actively maintained

Kanidm is a secure identity management platform providing SSO, passkeys (WebAuthn), and integrations like OAuth2/OIDC, RADIUS, and LDAP gateway for legacy apps.

5.3k stars354 forksMPL-2.0last commit 26 Aug 2026Actively maintained

Pomerium is an identity-aware access proxy that provides zero trust, per-request authorization to internal web apps and services without a traditional VPN.

5k stars350 forksApache-2.0last commit 25 Aug 2026Actively maintained

GLAuth is a lightweight LDAP/LDAPS authentication server for development, CI, and homelabs, supporting file, S3, SQL, or LDAP proxy backends and optional 2FA.

2.8k stars240 forksMITlast commit 25 Jul 2026Actively maintained

Enterprise-grade zero-trust access management platform providing WireGuard VPN with true protocol-level 2FA/MFA, plus integrated OpenID Connect SSO and user/device controls.

2.8k stars110 forkslast commit 10 Aug 2026Actively maintained

VoidAuth is a self-hosted SSO provider with OpenID Connect, ForwardAuth proxy auth, and built-in user and group management plus MFA and passkeys.

2.5k stars100 forksAGPL-3.0last commit 22 Aug 2026Actively maintained

Open-source Auth0/Clerk/Firebase Auth alternative with passkeys, MFA, SSO (OIDC/SAML), user management portal, and extensible auth flows for web and mobile apps.

2k stars125 forksApache-2.0last commit 26 Aug 2026Actively maintained

Mozilla Accounts (FxA) is an account and authentication service used by Mozilla clients, providing login, session management, and account-related APIs for Mozilla products.

685 stars236 forksMPL-2.0last commit 26 Aug 2026Actively maintained

Turnkey OAuth 2.0/OIDC authentication system with admin panel, REST APIs, RBAC, MFA, social login, and flexible deployment on Cloudflare Workers or Node.js.

635 stars68 forksMITlast commit 17 Aug 2026Actively maintained

A minimal, Rust-based forward authentication middleware for reverse proxies (Traefik, Caddy, nginx) using a passwd file and signed auth tokens.

157 stars8 forksMITlast commit 10 Jul 2026Actively maintained

Lightweight Go-based authentication gateway that provides unified SSO for Plex, Jellyfin, and Emby users with OIDC, MFA and an admin console. Runs in Docker and stores profiles in Postgres.

98 stars1 forksGPL-3.0last commit 19 Aug 2026Actively maintained