Overview
Mix (43 tools)
- License: 17 open source · 26 proprietary
- Hosting: 23 self-hosted · 16 SaaS · 4 both
Identity & Access Management (IAM) is the discipline of managing digital identities and controlling who can access which resources under what conditions. An IAM platform provides the central source of truth for user identities, authentication policies, and access decisions across every application and service in the organisation.
IAM platforms provide:
- Authentication – verifying user identity through passwords, MFA, passwordless (passkeys), or federated login (OIDC, SAML, LDAP)
- Single Sign-On (SSO) – one login grants access to all connected applications; eliminates per-app credentials and reduces password fatigue
- Directory services – a central user and group store (LDAP, SCIM, or proprietary) that applications query for identity data
- Federation – trust relationships between identity providers (IdPs) and service providers (SPs) using standards like OIDC, SAML 2.0, and WS-Federation
- Provisioning / deprovisioning – automated user lifecycle: create accounts on hire, update on role change, disable on termination; SCIM protocol for cross-domain provisioning
- Self-service – user-facing portals for password reset, profile updates, MFA enrollment, and access requests without helpdesk tickets
- Authorization policies – role-based (RBAC), attribute-based (ABAC), or policy-based access control defining who can access what
- Audit and compliance – immutable logs of every login, logout, MFA challenge, password change, and access decision; compliance reports for SOC 2, ISO 27001, HIPAA, GDPR
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
SSO Protocol Comparison
| Tool | OIDC | SAML | LDAP | SCIM | RADIUS |
|---|---|---|---|---|---|
| Authentik | Yes | Yes | Yes (outpost) | Yes (provider) | Yes (outpost) |
| Keycloak | Yes | Yes | Yes (federation) | No* | No |
| FreeIPA | No | No | Yes (native) | No | No |
| Kanidm | Yes | No | Yes | No | Yes |
| Zitadel | Yes | Yes | No | Yes | No |
| Authelia | Yes | No | No | No | No |
| Ory | Yes | No | No | No | No |
| Gluu / Janssen | Yes | Yes | Yes | Yes | No |
| Apache Syncope | Yes (WA) | Yes (WA) | No | Yes (ext) | No |
| Okta | Yes | Yes | Yes (agent) | Yes | Yes |
| Entra ID | Yes | Yes | Yes (sync) | Yes | No* |
| Google Identity | Yes | Yes | Yes (GCDS) | Yes | No |
| JumpCloud | Yes | Yes | Yes (native) | Yes | Yes |
| OneLogin | Yes | Yes | Yes (sync) | Yes | No |
| Ping Identity | Yes | Yes | Yes | Yes | Yes |
| ForgeRock | Yes | Yes | Yes (native) | Yes | No |
| Auth0 | Yes | Yes | No | Yes | No |
| WSO2 Identity Server | Yes | Yes | Yes | Yes | No |
| Apereo CAS | Yes | Yes | Yes | No | Yes |
| Shibboleth IdP | Yes* | Yes | Yes | No | No |
| Casdoor | Yes | Yes | Yes | Yes | No |
| FusionAuth | Yes | Yes | Yes* | Yes* | No |
| Curity | Yes | Yes* | Yes | Yes | No |
| Duende IdentityServer | Yes | Yes* | No | No | No |
| WorkOS | Yes | Yes | No | Yes | No |
| Stytch | Yes | Yes | No | Yes | No |
| Clerk | Yes | Yes | No | Yes | No |
| Descope | Yes | Yes | No | Yes | No |
| Frontegg | Yes | Yes | No | Yes | No |
* = requires third-party plugin or additional service
MFA Capabilities (Built-in)
| Tool | TOTP | WebAuthn | Push | SMS | Duo |
|---|---|---|---|---|---|
| Authentik | Yes | Yes | No | Yes | Yes |
| Keycloak | Yes | Yes | No | No* | No |
| FreeIPA | Yes | No | No | No | No |
| Kanidm | Yes | Yes | No | No | No |
| Zitadel | Yes | Yes | No | Yes | No |
| Authelia | Yes | Yes | No | No | Yes |
| Okta | Yes | Yes | Yes | Yes | No |
| Entra ID | Yes | Yes | Yes | Yes | No |
| JumpCloud | Yes | Yes | Yes | Yes | Yes |
* = available via SPI or extension
Deployment Model
| Tool | Self-Hosted | SaaS | License |
|---|---|---|---|
| Authentik | Yes | Yes (managed) | MIT (custom) |
| Keycloak | Yes | No | Apache 2.0 |
| FreeIPA | Yes | No | GPL-3.0 |
| Kanidm | Yes | No | MPL-2.0 |
| Zitadel | Yes | Yes | Apache 2.0 |
| Authelia | Yes | No | Apache 2.0 |
| Ory | Yes | Yes | Apache 2.0 |
| Gluu / Janssen | Yes | Yes | Apache 2.0 |
| MidPoint | Yes | No | Apache 2.0 |
| Apache Syncope | Yes | No | Apache 2.0 |
| Okta | No | Yes | Proprietary |
| Entra ID | No | Yes | Proprietary |
| Google Identity | No | Yes | Proprietary |
| JumpCloud | No | Yes | Proprietary |
| OneLogin | No | Yes | Proprietary |
| Ping Identity | Yes | Yes | Proprietary |
| ForgeRock | Yes | Yes | Proprietary |
| SailPoint | No | Yes | Proprietary |
| Saviynt | No | Yes | Proprietary |
| Auth0 | No | Yes | Proprietary |
| IBM Verify | Yes | Yes | Proprietary |
| CyberArk Identity | No | Yes | Proprietary |
| Omada | No | Yes | Proprietary |
| 389 DS | Yes | No | GPL-2.0 |
| OpenLDAP | Yes | No | OLDAP-2.8 |
| WSO2 Identity Server | Yes | No | Apache 2.0 |
| Apereo CAS | Yes | No | Apache 2.0 |
| Shibboleth IdP | Yes | No | Apache 2.0 |
| Casdoor | Yes | No | Apache 2.0 |
| SuperTokens | Yes | Yes | Apache 2.0 |
| FusionAuth | Yes | Yes | Proprietary |
| Curity | Yes | No | Proprietary |
| Duende IdentityServer | Yes | No | Duende (source-available) |
| WorkOS | No | Yes | Proprietary |
| Stytch | No | Yes | Proprietary |
| Clerk | No | Yes | Proprietary |
| Descope | No | Yes | Proprietary |
| Frontegg | No | Yes | Proprietary |
| One Identity Manager | Yes | Yes | Proprietary |
| Oracle Identity Governance | Yes | No | Proprietary |
| RSA Governance & Lifecycle | Yes | Yes | Proprietary |
| NetIQ Identity Manager | Yes | No | Proprietary |
| Microsoft Identity Manager | Yes | No | Proprietary |
IGA Capabilities
| Tool | Access Reviews | SoD | Role Mining | Workflows | SCIM Prov. |
|---|---|---|---|---|---|
| MidPoint | Yes | Yes | Yes | Yes | Yes |
| Apache Syncope | No | No | No | Yes | Yes |
| SailPoint | Yes | Yes | Yes | Yes | Yes |
| Saviynt | Yes | Yes | Yes | Yes | Yes |
| Omada | Yes | Yes | Yes | Yes | Yes |
| IBM Verify | Yes | Yes | Yes | Yes | Yes |
| Okta (Governance) | Yes | No | No | Yes | Yes |
| Entra ID (P2) | Yes | No | No | Yes | Yes |
| Authentik | No | No | No | Yes* | Yes |
| Keycloak | No | No | No | No | No* |
| One Identity Manager | Yes | Yes | Yes | Yes | Yes |
| Oracle Identity Governance | Yes | Yes | Yes | Yes | Yes |
| RSA Governance & Lifecycle | Yes | Yes | Yes | Yes | Yes |
| NetIQ Identity Manager | No* | No* | No | Yes | Yes |
| Microsoft Identity Manager | No | No | No | Yes | No |
* = limited or via extension
Competing with Entra ID Governance
Entra ID is the identity layer of record in most enterprises, so the IGA market’s main competitive axis is no longer vendor-versus-vendor – it is dedicated IGA versus Microsoft’s bundled, good-enough governance. Every vendor in the tables above is positioned, implicitly or explicitly, against that gravity.
Note on sourcing: outside the Microsoft release notes and SailPoint’s published financials, most of the claims below come from vendors or review sites selling against each other. They are directional, not benchmarks.
The Microsoft position
- Price is public and bundled. Entra ID Governance is a ~$7/user/month add-on on top of Entra ID P1/P2; the Entra Suite bundle is ~$12/user/month. It is the only major IGA product with list pricing – SailPoint, Saviynt, Omada and One Identity are all quote-only, which Microsoft turns into a procurement argument.
- Zero integration cost in a Microsoft-centric estate. No connector project for Entra ID, M365, Azure RBAC or the app gallery; governance rides the directory that already exists.
- The cited gaps are closing. 2026 shipped account discovery for connected applications (GA, May) – which surfaces orphan accounts and addresses the reconciliation gap analysts had flagged as missing – plus Tenant Governance (GA, August) with multi-tenant drift monitoring, five Lifecycle Workflows additions including what-if simulation and sponsorless guest cleanup, Conditional Access gating of PIM role activation, and Cloud Sync provisioning from Entra ID to on-premises AD (preview).
- Metering is tightening. Since 30 January 2026 guest governance requires a linked Azure subscription under a monthly-active-user model.
Where the dedicated platforms still hold ground
- Non-Microsoft connectivity. Outside the gallery, Entra is largely account and group provisioning over generic SCIM; entitlement-level detail inside the target application stays invisible.
- Segregation of duties. No native cross-application SoD; enforcement is bounded by the accounts Entra manages, and modelling is access-package-level.
- Role modelling. Single-tier roles built from manually defined access packages; no role mining.
- Reconciliation. Historically absent; partly addressed by the 2026 account-discovery release.
- Local and non-federated accounts. Accounts created directly in a target application fall outside the governance surface unless wired up through SCIM, SAML or an API connector.
- On-premises privileged access. Cloud PIM has no equivalent for on-prem AD roles and groups.
- Audit packaging. Access-review output and lifecycle logs need explicit harvesting to reach the format an auditor expects.
- Licensing scope. Workforce-wide access reviews mean licensing the whole workforce, which hits mid-market budgets hardest.
Counter-positioning by vendor
- SailPoint – breadth plus entitlement depth: 250+ bi-directional connectors capturing entitlement-level change, AI-built roles and outlier detection, core governance in the base suite rather than add-on tiers. Strongest on large heterogeneous estates with on-prem, legacy and regulated workloads.
- Saviynt – cloud-native convergence: IGA, Cloud PAM, application access governance and data access governance on one platform, so Entra governance plus a separate PAM tool looks like two purchases. Strongest on multi-cloud estates and fine-grained SAP / Oracle / Workday entitlements.
- Omada – configurable mid-enterprise IGA with a fixed-scope accelerator (roughly 12-16 weeks), aimed at buyers for whom SailPoint is too heavy and Entra too shallow. Strongest on mid-to-large regulated enterprises wanting a bounded project.
- One Identity – deep Active Directory and SAP management, precisely where Entra’s on-premises story is weakest. Strongest on AD-heavy and SAP-heavy hybrid estates.
- Okta Identity Governance – the same adjacency play as Microsoft, run from the other IdP: governance layered on an existing Okta tenant instead of a separate platform. Strongest on SaaS-first estates already on Okta.
- Pathlock / SafePaaS – fine-grained ERP and SAP SoD down to transaction level, a domain Entra does not address at all. Strongest on SOX-driven ERP controls.
- MidPoint / Apache Syncope – no per-seat licence at all, and full schema and workflow control. Strongest on cost-constrained or sovereignty-constrained deployments.
Coexistence is the dominant outcome, not displacement
The recurring enterprise pattern is Entra for authentication, MFA and conditional access, with a dedicated IGA platform governing access across the whole estate – and Entra treated as one more managed target. SailPoint’s own comparison page positions the product as complementary to Entra rather than a replacement, which is a fair indicator of how the deals actually land. Entra displaces dedicated IGA mainly at the low end: Microsoft-centric mid-market organisations whose requirements stop at access packages, access reviews and joiner/mover/leaver.
The market data is consistent with coexistence rather than erosion. SailPoint reported total ARR of $1.231B in its fiscal Q2 2027, up 25% year over year, with SaaS ARR up 36% to $847M and AI-attributed ARR above $70M.
The analyst picture shifted in 2026
Gartner’s 2026 IGA publication (28 August 2026) is a Market Guide, not a Magic Quadrant – buyers get a representative-vendor list rather than a ranking, and the named vendors run long (Okta, SailPoint, Pathlock, SafePaaS, ObserveID, Fischer Identity and Intragen among them), which itself signals a fragmenting market. Its framing is that AI scale and complexity require rethinking governance, with unified governance of all identity types as the recommended target.
KuppingerCole still ranks. Its 2026 IGA Leadership Compass (19 May 2026) drew Overall Leader claims from Saviynt, Omada, cidaas and Eviden; a separate Lean IGA Leadership Compass covers the midmarket, where Pathlock was named Overall Leader. Okta announced a leader placement in the 2026 IGA compass as well.
The next front: AI agent and non-human identity
This is where the competition is actually being fought in 2026, and the split is structural – the platforms issue agent identities, the IGA vendors govern agents issued anywhere.
- Microsoft – Entra Agent ID is available to all Entra customers and mints an identity when an agent is created, but extending Entra’s security controls to agents requires an Agent 365 licence. The existing Agent ID registry Graph API is being deprecated in favour of an Agent 365-powered API.
- Okta – Agent SSO went GA 24 August 2026; agents land in Universal Directory with a human owner and short-lived scoped tokens. Discovery of unsanctioned agents is a separate “Okta for AI Agents” subscription.
- SailPoint – split its platform into Agentic Fabric (non-human and agent identities) and Human Fabric (workforce) on Atlas, and announced Autonomous Agents in October 2026. A-ISPM and the Harbor Pilot Policy Agent are slated for Q4 FY27. Its pitch is that agents extend an identity programme the buyer already funds, rather than forming a new category.
- Saviynt – bundles Zuma for agent and non-human identity governance in the same platform rather than as separate modules.
Microsoft’s structural advantage is that agents created in Copilot and Azure AI Foundry get Entra identities by default, so it owns the issuance point. The IGA vendors’ counter is that issuance is not governance: an enterprise running agents across Microsoft, AWS, Google and bespoke frameworks still needs one place to certify what those agents can reach.
Authentik Integration Notes
For customer IdPs that an organisation may already use, these are the federation paths to Authentik:
| Customer IdP | Federation Method |
|---|---|
| Entra ID | OIDC or SAML federation; Authentik as SP or IdP |
| Okta | SAML or OIDC federation; SCIM sync |
| OIDC federation; Google as social login source | |
| JumpCloud | SAML federation; LDAP sync via outpost |
| On-prem AD | LDAP sync to Authentik; Kerberos via FreeIPA bridge |
Tools
43 tools.
389 Directory Server
389 Directory Server (389 DS) is an enterprise- grade LDAP server developed by Red Hat as part of the Fedora Project. It is the LDAP backend used by FreeIPA and Red Hat Identity Management (IdM).
License: GPL-3.0-or-later (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Apache Syncope
Apache Syncope is an open-source system for managing digital identities in enterprise environments, spanning identity management (provisioning) and access management (SSO).
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Apereo CAS
Apereo CAS is an open-source enterprise single sign-on server supporting the CAS protocol, SAML2, OIDC/OAuth2, and WS-Federation, with MFA and delegated authentication.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Auth0
Auth0 is a developer-focused identity platform specializing in customer identity and access management (CIAM).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Directory / LDAP
Authelia
Authelia is an open-source authentication and authorization server designed primarily as a forward-authentication proxy for reverse proxies such as Nginx, Traefik, HAProxy, and Caddy.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Authentik
Authentik is an open-source identity provider and single sign-on platform built with Python (Django) on the backend and Go-based outposts for protocol translation.
License: MIT (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Azure AD / Entra ID
Microsoft Entra ID (formerly Azure Active Directory) is the cloud-based identity and access management service within the Microsoft ecosystem.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Casdoor
Casdoor is an open-source, UI-first Identity and Access Management (IAM) / Single Sign-On (SSO) platform and identity provider supporting OAuth 2.0, OIDC, SAML, CAS, LDAP, and SCIM.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Clerk
Clerk is a developer-focused CIAM platform providing prebuilt embeddable UI components, social and enterprise SSO login, MFA, passkeys, organizations/B2B multi-tenancy, and managed session handling.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Curity Identity Server
Curity Identity Server is a proprietary, self-hostable OAuth 2.0 / OpenID Connect server and token service focused on API security and financial-grade (FAPI) profiles, with a free Community edition.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
CyberArk Identity
CyberArk Identity (formerly Idaptive, originally Centrify Identity Services) is a cloud-based workforce identity platform that provides SSO, adaptive MFA, lifecycle management, and endpoint authentication.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Descope
Descope is a no/low-code customer identity (CIAM) platform built around a drag-and-drop authentication “Flows” builder covering passwordless, passkeys, social, SSO, and MFA.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Duende IdentityServer
Duende IdentityServer is a certified OpenID Connect and OAuth 2.x framework shipped as a NuGet library for ASP.NET Core, the commercially licensed successor to the open-source IdentityServer4.
License: LicenseRef-Duende-Software-License (source-available) · Kind: library · Deploy: package, docker, k8s, direct · SSO: none · Tags: iam, sso, oidc, oauth2, dotnet, token-service
ResorsIT usage: Library
ForgeRock
ForgeRock is an enterprise identity platform that provides access management (AM), identity management (IDM), and directory services (DS) as a comprehensive identity suite.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
FreeIPA
FreeIPA (Free Identity, Policy, and Audit) is an integrated identity management solution for Linux and UNIX environments, developed primarily by Red Hat.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Frontegg
Frontegg is a B2B customer identity and user-management platform providing self-serve enterprise SSO, SCIM directory sync, multi-tenancy, roles/entitlements, and an admin portal.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
FusionAuth
FusionAuth is a developer-focused Customer Identity and Access Management (CIAM) platform with a free self-hostable Community edition and paid tiers, supporting OIDC, OAuth2, SAML, MFA, and passwordless authentication.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, docker, k8s, saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Provisioned account · Vaulted credential
Gluu / Janssen
Gluu is an enterprise identity platform whose open-source Janssen Project core provides a certified OIDC provider, SCIM and FIDO servers, and SAML federation; Gluu Flex is the commercial distribution.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Provisioned account
Google Cloud Identity
Google Cloud Identity is Google’s enterprise identity and device management service. It provides a cloud-hosted directory, SSO via OIDC/SAML, MFA, device management, and security policies.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Directory / LDAP
IBM Security Verify
IBM Security Verify is IBM’s identity and access management portfolio, encompassing both SaaS and on-premises products.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Provisioned account
JumpCloud
JumpCloud is a cloud-based directory platform that provides unified identity, device, and access management from a single SaaS console.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Kanidm
Kanidm is a modern identity management server written entirely in Rust, designed as a secure, performant alternative to traditional LDAP-based directory services.
License: MPL-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Keycloak
Keycloak is an open-source identity and access management platform developed by Red Hat and donated to the Cloud Native Computing Foundation (CNCF) as an incubating project.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Microsoft Identity Manager (MIM)
Microsoft Identity Manager (MIM 2016) is a legacy on-premises identity synchronization and provisioning product (successor to Forefront Identity Manager / MIIS); Microsoft now steers customers to Entra ID Governance.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
MidPoint (Evolveum)
MidPoint is an open-source Identity Governance and Administration (IGA) platform developed by Evolveum.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Provisioned account · Vaulted credential
NetIQ Identity Manager (OpenText)
NetIQ Identity Manager (OpenText; formerly Novell/NetIQ IDM) is an enterprise identity provisioning and synchronization engine that syncs identities bidirectionally across AD, LDAP, HR systems, databases, and apps via an eDirectory Identity Vault.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Okta
Okta is the market-leading cloud identity platform, providing SSO, MFA, lifecycle management, API access management, and identity governance as a SaaS service.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Provisioned account · Vaulted credential
Omada
Omada is a European identity governance and administration (IGA) platform headquartered in Denmark. The platform provides identity lifecycle management, access governance, compliance management, and audit reporting.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Provisioned account · Vaulted credential
One Identity Manager
One Identity Manager is an enterprise Identity Governance and Administration (IGA) platform covering identity lifecycle, access governance, attestation, and segregation of duties, with strong SAP and Active Directory/Entra connectors.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
OneLogin
OneLogin is a cloud-based identity and access management platform that provides SSO, MFA, directory integration, and user provisioning.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Directory / LDAP
OpenLDAP
OpenLDAP is the reference open-source implementation of the Lightweight Directory Access Protocol (LDAP). It has been in development since 1998 and is one of the most widely deployed LDAP servers globally.
License: OLDAP-2.8 (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Oracle Identity Governance
Oracle Identity Governance (OIG) is an enterprise IGA platform (formerly Oracle Identity Manager) providing user provisioning, access certification, segregation of duties, role management, and request workflows on Java/WebLogic.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Ory (Kratos / Hydra / Keto)
Ory is a modular, open-source identity infrastructure suite consisting of several independent components: Kratos (identity and user management), Hydra (OAuth 2.0 / OIDC server), Keto (authorization / permissions), and Oathkeeper (API gatewa…
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Ping Identity
Ping Identity is an enterprise identity platform offering a comprehensive suite of products for SSO, MFA, directory services, API security, and identity verification.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Provisioned account
RSA Governance & Lifecycle
RSA Governance & Lifecycle (formerly RSA Identity Governance & Lifecycle / Aveksa) is an enterprise IGA platform for access certification, access requests, provisioning, segregation of duties, and role management.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
SailPoint
SailPoint is the market leader in Identity Governance and Administration (IGA), providing identity security solutions focused on access governance, compliance, and lifecycle management.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Saviynt
Saviynt is a cloud-native Identity Governance and Administration (IGA) platform that converges identity governance, privileged access management, application access governance, and third-party access governance into a single cloud service.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Shibboleth IdP
Shibboleth IdP is an open-source SAML 2.0 identity provider dominant in academic and research federations (InCommon, eduGAIN), with OIDC support via the OIDC OP plugin.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Stytch
Stytch is a developer-first authentication and CIAM platform offering passwordless login, passkeys, OAuth, B2B SSO and SCIM, plus device-fingerprint fraud and bot protection, delivered as APIs and SDKs.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
SuperTokens
SuperTokens is an open-source, developer-focused authentication solution (session management, email/password, passwordless, social login, MFA, multi-tenancy); a self-hostable alternative to Auth0 and Firebase Auth.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s, saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
WorkOS
WorkOS is a developer platform that delivers enterprise-readiness features – SSO, SCIM Directory Sync, audit logs, and user management – as APIs and drop-in UI for B2B SaaS applications.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
WSO2 Identity Server
WSO2 Identity Server is an open-source identity and access management (IAM) and CIAM platform providing SSO, identity federation, adaptive MFA, and SCIM-based provisioning.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Provisioned account · Vaulted credential
Zitadel
Zitadel is a cloud-native identity management platform written in Go, designed for multi-tenant SaaS environments. It provides OIDC, SAML, and SCIM support with a strong focus on developer experience and API-first design.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
