<story><title>Authelia is an open-source authentication/authorization server with 2FA/SSO</title><url>https://github.com/authelia/authelia</url></story><parent_chain><item><author>hardwaresofton</author><text>Personally I think of Authelia and Keratin as really good projects in the don&amp;#x27;t-build-auth-into-your-apps-ever-again space. If auth isn&amp;#x27;t already built into your app gateway&amp;#x2F;mesh&amp;#x2F;proxy, then these services might be something worth dropping alongside.&lt;p&gt;A few more projects in this space:&lt;p&gt;- Keycloak (you won&amp;#x27;t get fired for picking this)[0]&lt;p&gt;- CloudFoundry&amp;#x27;s UAA[1]&lt;p&gt;- Gluu [2]&lt;p&gt;- ORY (Hydra + friends)[3]&lt;p&gt;- Keratin [4]&lt;p&gt;- OpenUnison [5]&lt;p&gt;- Dex[6]&lt;p&gt;- Netlify&amp;#x27;s GoTrue[7]&lt;p&gt;All of these solutions are a bit different but here are some of the axes:&lt;p&gt;- Whether or not they function as an OAuth provider&lt;p&gt;- Whether they&amp;#x27;re centered around application-user-login via mechanisms like email&amp;#x2F;password, application auth, or SSO&lt;p&gt;- Whether or not they serve as a proxy to another down-the-line OAuth provider (Dex, GoTrue)&lt;p&gt;- GUI availability&lt;p&gt;- F&amp;#x2F;OSS-ness (basically all of them have very permissive licenses)&lt;p&gt;[EDIT] More entries for this list in another comment @ &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=26411457&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=26411457&lt;/a&gt;&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.keycloak.org&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.keycloak.org&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cloudfoundry&amp;#x2F;uaa&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cloudfoundry&amp;#x2F;uaa&lt;/a&gt;&lt;p&gt;[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gluu.org&amp;#x2F;docs&amp;#x2F;gluu-server&amp;#x2F;4.2&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gluu.org&amp;#x2F;docs&amp;#x2F;gluu-server&amp;#x2F;4.2&amp;#x2F;&lt;/a&gt;&lt;p&gt;[3]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ory&amp;#x2F;hydra#what-is-ory-hydra&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ory&amp;#x2F;hydra#what-is-ory-hydra&lt;/a&gt;&lt;p&gt;[4]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;keratin.github.io&amp;#x2F;authn-server&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;keratin.github.io&amp;#x2F;authn-server&amp;#x2F;&lt;/a&gt;&lt;p&gt;[5]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;tremolosecurity&amp;#x2F;openunison&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;tremolosecurity&amp;#x2F;openunison&lt;/a&gt;&lt;p&gt;[6]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;dexidp&amp;#x2F;dex&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;dexidp&amp;#x2F;dex&lt;/a&gt;&lt;p&gt;[7]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;netlify&amp;#x2F;gotrue&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;netlify&amp;#x2F;gotrue&lt;/a&gt;</text></item></parent_chain><comment><author>mamcx</author><text>Exist other 2 major things that I have tried to find but is rarely missed:&lt;p&gt;1- GOOD multi-tenant support.&lt;p&gt;Without extra weird hoops like with ORY.&lt;p&gt;How this must be? Just passing a subdomain is all necessary to route and it need to make easy to create&amp;#x2F;remove tenants as part of MY logic, not need to orchestrate stuff.&lt;p&gt;2- Use my own tables. (or allow to set FX&amp;#x2F;new fields)&lt;p&gt;I appreciate to have automated all the stuff but I have much logic around what is a &amp;quot;user&amp;quot; (and in a recent project, 2 kinds of user in 2 different tables: salesman&amp;#x2F;customers).&lt;p&gt;Ideally, this stuff only need to do &amp;quot;SELECT fields_for_auth FROM my_table&amp;quot;</text></comment>
<story><title>Authelia is an open-source authentication/authorization server with 2FA/SSO</title><url>https://github.com/authelia/authelia</url></story><parent_chain><item><author>hardwaresofton</author><text>Personally I think of Authelia and Keratin as really good projects in the don&amp;#x27;t-build-auth-into-your-apps-ever-again space. If auth isn&amp;#x27;t already built into your app gateway&amp;#x2F;mesh&amp;#x2F;proxy, then these services might be something worth dropping alongside.&lt;p&gt;A few more projects in this space:&lt;p&gt;- Keycloak (you won&amp;#x27;t get fired for picking this)[0]&lt;p&gt;- CloudFoundry&amp;#x27;s UAA[1]&lt;p&gt;- Gluu [2]&lt;p&gt;- ORY (Hydra + friends)[3]&lt;p&gt;- Keratin [4]&lt;p&gt;- OpenUnison [5]&lt;p&gt;- Dex[6]&lt;p&gt;- Netlify&amp;#x27;s GoTrue[7]&lt;p&gt;All of these solutions are a bit different but here are some of the axes:&lt;p&gt;- Whether or not they function as an OAuth provider&lt;p&gt;- Whether they&amp;#x27;re centered around application-user-login via mechanisms like email&amp;#x2F;password, application auth, or SSO&lt;p&gt;- Whether or not they serve as a proxy to another down-the-line OAuth provider (Dex, GoTrue)&lt;p&gt;- GUI availability&lt;p&gt;- F&amp;#x2F;OSS-ness (basically all of them have very permissive licenses)&lt;p&gt;[EDIT] More entries for this list in another comment @ &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=26411457&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=26411457&lt;/a&gt;&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.keycloak.org&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.keycloak.org&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cloudfoundry&amp;#x2F;uaa&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cloudfoundry&amp;#x2F;uaa&lt;/a&gt;&lt;p&gt;[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gluu.org&amp;#x2F;docs&amp;#x2F;gluu-server&amp;#x2F;4.2&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gluu.org&amp;#x2F;docs&amp;#x2F;gluu-server&amp;#x2F;4.2&amp;#x2F;&lt;/a&gt;&lt;p&gt;[3]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ory&amp;#x2F;hydra#what-is-ory-hydra&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ory&amp;#x2F;hydra#what-is-ory-hydra&lt;/a&gt;&lt;p&gt;[4]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;keratin.github.io&amp;#x2F;authn-server&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;keratin.github.io&amp;#x2F;authn-server&amp;#x2F;&lt;/a&gt;&lt;p&gt;[5]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;tremolosecurity&amp;#x2F;openunison&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;tremolosecurity&amp;#x2F;openunison&lt;/a&gt;&lt;p&gt;[6]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;dexidp&amp;#x2F;dex&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;dexidp&amp;#x2F;dex&lt;/a&gt;&lt;p&gt;[7]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;netlify&amp;#x2F;gotrue&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;netlify&amp;#x2F;gotrue&lt;/a&gt;</text></item></parent_chain><comment><author>mooreds</author><text>One thing that is missing from this list is open source language specific libraries. Projects such as &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;oauthlib.readthedocs.io&amp;#x2F;en&amp;#x2F;latest&amp;#x2F;oauth2&amp;#x2F;server.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;oauthlib.readthedocs.io&amp;#x2F;en&amp;#x2F;latest&amp;#x2F;oauth2&amp;#x2F;server.html&lt;/a&gt; and &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;doorkeeper-gem&amp;#x2F;doorkeeper&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;doorkeeper-gem&amp;#x2F;doorkeeper&lt;/a&gt;&lt;p&gt;Depending on your use case, for example if you only have one application, you might be better off running something embedded in your app, or independent but using the same runtime&amp;#x2F;deployment environment. Then, when you are ready to add another app or integration, you should be able to introduce a standalone auth system more easily if appropriate (because all your auth interactions should be relatively standardized). I&amp;#x27;m a big fan of standalone auth systems as a way to simplify access control and give a single view of a user&amp;#x2F;customer, but you can also succeed using open source embedded libraries.&lt;p&gt;When the moment comes to introduce a standalone system, you should consider a few dimensions (this list pulled from a previous comment of mine: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=26360048&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=26360048&lt;/a&gt; ):&lt;p&gt;&lt;pre&gt;&lt;code&gt;   * open source or not
   * standalone application or library&amp;#x2F;framework you integrate
   * self hosted or SaaS
   * authentication, authorization, user management or all three?
   * standards coverage
   * SSO support
   * integrations with other auth tech (LDAP)
   * which OAuth grants are supported
   * cost
   * operational complexity&amp;#x2F;support for your deployment environment
   * specific features if needed (for example, customization of the look and feel with themes, or customization of the login flow with something like Keycloak&amp;#x27;s plugin system)
   * documentation and developer experience
&lt;/code&gt;&lt;/pre&gt;
These dimensions all matter to varying degrees depending on your team and needs.&lt;p&gt;Disclosure: I work for &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fusionauth.io&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fusionauth.io&amp;#x2F;&lt;/a&gt; which has open source supporting libraries and docs, but which is itself not open source.&lt;p&gt;EDIT: added cost, operational complexity and customization to the list.</text></comment>