Authentik

An open-source identity provider that issues and validates OpenID Connect, OAuth 2 and SAML tokens, so people sign in once and reach every application you run. It stands out for a flow-based admin interface, expression-based policies, LDAP and Active Directory sources, two-factor support, and outposts that put single sign-on in front of existing apps.

Teams use it to centralise logins for internal tools, cloud services and homelab dashboards, and to onboard and offboard users without touching each application.

Self-hosted through KibanOS, user records stay on your own machines, there is no per-seat fee, and the database is straightforward to back up and restore.