Kanidm is a simple and secure identity management platform, allowing other applications and services to offload the challenge of authenticating and storing identities to Kanidm.
The goal of this project is to be a complete identity provider, covering the broadest possible set of requirements and integrations. You should not need any other components (like Keycloak) when you use Kanidm - we already have everything you need!
To achieve this we rely heavily on strict defaults, simple configuration, and self-healing components. This allows Kanidm to run from small home labs, for families, small business, and all the way to the largest enterprise needs.
If you want to host your own authentication service, then Kanidm is for you!
Features
- Webauthn (passkeys) for secure cryptographic authentication
- OAuth2/OIDC Authentication provider for web SSO
- OAuth Application Portal/Gateway allowing easy access to linked applications
- Linux/UNIX integration with offline authentication
- SSH key distribution to Linux/UNIX systems
- RADIUS for network and VPN authentication
- Read only LDAPS gateway for Legacy Systems
- Complete CLI tooling for Administration
- User Self Service via the WebUI
External References
- Evaluation Quickstart - Kanidm Administration
- Introduction to Kanidm - Kanidm Administration
- GitHub - kanidm/kanidm: Kanidm: A simple, secure, and fast identity management platform
authentik is an IdP (Identity Provider) and SSO (Single Sign On) platform that is built with security at the forefront of every piece of code, every feature, with an emphasis on flexibility and versatility.
With authentik, site administrators, application developers, and security engineers have a dependable and secure solution for authentication in almost any type of environment. There are robust recovery actions available for the users and applications, including user profile and password management. You can quickly edit, deactivate, or even impersonate a user profile, and set a new password for new users or reset an existing password.
You can use authentik in an existing environment to add support for new protocols, so introducing authentik to your current tech stack doesn't present re-architecting challenges. We support all of the major providers, such as OAuth2, SAML, LDAP, and SCIhttps://docs.goauthentik.io/M, so you can pick the protocol that you need for each application.
We offer two versions of authentik: the forever-free open source project upon which everything is built, and our open core, source available Enterprise version, with a Support center and additional features.
Authelia is an open-source authentication and authorization server and portal fulfilling the identity and access management (IAM) role of information security in providing multi-factor authentication and single sign-on (SSO) for your applications via a web portal. Authelia is an OpenID Connect 1.0 Provider which is OpenID Certified™ allowing comprehensive integrations, and acts as a companion for common reverse proxies.
A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.
A Federated OpenID Connect Provider
Integrate any identity provider into your application using OpenID Connect.
Federate across upstream identity providers with ease.
OpenID Connect is a simple identity layer built on top of the OAuth 2.0 protocol, which allows clients to verify the identity of an end user based on the authentication performed by an authorization server or identity provider (IdP), as well as to obtain basic profile information about the end user in an interoperable and REST-like manner. OpenID Connect specifies a RESTful HTTP API, using JSON as a data format.
OpenID Connect is an increasingly common authentication protocol: when an app prompts you to authenticate using your Facebook or Google+ credentials, the app is probably using OpenID Connect.
OpenID Connect allows a range of clients, including web-based, mobile, and JavaScript clients, to request and receive information about authenticated sessions and end-users.
OneLogin provides a custom connector option that makes it easy to configure your OpenID Connect-enabled app to use OneLogin as the Identity Provider (IdP) in an OpenID Connect flow.
For more information about API authorization, see How to setup an API Authorization PoC.
Choosing the wrong authentication protocol could undermine security and limit future expansion. These are the recommended protocols for common use cases.