Keycloak

Keycloak is an identity and access management server that provides single sign-on, role based access and user federation for web applications and services. It speaks OAuth 2, OpenID Connect and SAML, and can map accounts from LDAP or Active Directory, so existing directories keep working while you add centralised login, MFA and a rich admin console.

Common deployments place it in front of internal dashboards, customer portals and admin tools, and it also issues tokens for APIs and other services.

Running it on infrastructure you control means credentials never leave your network, there are no per-user licence costs, and the instance and its database can be backed up and restored like any other service.