License & Deployment Mix: 24 tools – 11 OSS, 11 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
Overview
Identity & Access Management (IAM) is the discipline of managing digital identities and controlling who can access which resources under what conditions. An IAM platform provides the central source of truth for user identities, authentication policies, and access decisions across every application and service in the organisation.
IAM platforms provide:
- Authentication – verifying user identity through passwords, MFA, passwordless (passkeys), or federated login (OIDC, SAML, LDAP)
- Single Sign-On (SSO) – one login grants access to all connected applications; eliminates per-app credentials and reduces password fatigue
- Directory services – a central user and group store (LDAP, SCIM, or proprietary) that applications query for identity data
- Federation – trust relationships between identity providers (IdPs) and service providers (SPs) using standards like OIDC, SAML 2.0, and WS-Federation
- Provisioning / deprovisioning – automated user lifecycle: create accounts on hire, update on role change, disable on termination; SCIM protocol for cross-domain provisioning
- Self-service – user-facing portals for password reset, profile updates, MFA enrollment, and access requests without helpdesk tickets
- Authorization policies – role-based (RBAC), attribute-based (ABAC), or policy-based access control defining who can access what
- Audit and compliance – immutable logs of every login, logout, MFA challenge, password change, and access decision; compliance reports for SOC 2, ISO 27001, HIPAA, GDPR
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
SSO Protocol Comparison
| Tool | OIDC | SAML | LDAP | SCIM | RADIUS |
|---|---|---|---|---|---|
| Authentik | Yes | Yes | Yes (outpost) | Yes (provider) | Yes (outpost) |
| Keycloak | Yes | Yes | Yes (federation) | No* | No |
| FreeIPA | No | No | Yes (native) | No | No |
| Kanidm | Yes | No | Yes | No | Yes |
| Zitadel | Yes | Yes | No | Yes | No |
| Authelia | Yes | No | No | No | No |
| Ory | Yes | No | No | No | No |
| Gluu / Janssen | Yes | Yes | Yes | Yes | No |
| Okta | Yes | Yes | Yes (agent) | Yes | Yes |
| Entra ID | Yes | Yes | Yes (sync) | Yes | No* |
| Google Identity | Yes | Yes | Yes (GCDS) | Yes | No |
| JumpCloud | Yes | Yes | Yes (native) | Yes | Yes |
| OneLogin | Yes | Yes | Yes (sync) | Yes | No |
| Ping Identity | Yes | Yes | Yes | Yes | Yes |
| ForgeRock | Yes | Yes | Yes (native) | Yes | No |
| Auth0 | Yes | Yes | No | Yes | No |
* = requires third-party plugin or additional service
MFA Capabilities (Built-in)
| Tool | TOTP | WebAuthn | Push | SMS | Duo |
|---|---|---|---|---|---|
| Authentik | Yes | Yes | No | Yes | Yes |
| Keycloak | Yes | Yes | No | No* | No |
| FreeIPA | Yes | No | No | No | No |
| Kanidm | Yes | Yes | No | No | No |
| Zitadel | Yes | Yes | No | Yes | No |
| Authelia | Yes | Yes | No | No | Yes |
| Okta | Yes | Yes | Yes | Yes | No |
| Entra ID | Yes | Yes | Yes | Yes | No |
| JumpCloud | Yes | Yes | Yes | Yes | Yes |
* = available via SPI or extension
Deployment Model
| Tool | Self-Hosted | SaaS | License |
|---|---|---|---|
| Authentik | Yes | Yes (managed) | MIT (custom) |
| Keycloak | Yes | No | Apache 2.0 |
| FreeIPA | Yes | No | GPL-3.0 |
| Kanidm | Yes | No | MPL-2.0 |
| Zitadel | Yes | Yes | Apache 2.0 |
| Authelia | Yes | No | Apache 2.0 |
| Ory | Yes | Yes | Apache 2.0 |
| Gluu / Janssen | Yes | Yes | Apache 2.0 |
| MidPoint | Yes | No | Apache 2.0 |
| Okta | No | Yes | Proprietary |
| Entra ID | No | Yes | Proprietary |
| Google Identity | No | Yes | Proprietary |
| JumpCloud | No | Yes | Proprietary |
| OneLogin | No | Yes | Proprietary |
| Ping Identity | Yes | Yes | Proprietary |
| ForgeRock | Yes | Yes | Proprietary |
| SailPoint | No | Yes | Proprietary |
| Saviynt | No | Yes | Proprietary |
| Auth0 | No | Yes | Proprietary |
| IBM Verify | Yes | Yes | Proprietary |
| CyberArk Identity | No | Yes | Proprietary |
| Omada | No | Yes | Proprietary |
| 389 DS | Yes | No | GPL-2.0 |
| OpenLDAP | Yes | No | OLDAP-2.8 |
IGA Capabilities
| Tool | Access Reviews | SoD | Role Mining | Workflows | SCIM Prov. |
|---|---|---|---|---|---|
| MidPoint | Yes | Yes | Yes | Yes | Yes |
| SailPoint | Yes | Yes | Yes | Yes | Yes |
| Saviynt | Yes | Yes | Yes | Yes | Yes |
| Omada | Yes | Yes | Yes | Yes | Yes |
| IBM Verify | Yes | Yes | Yes | Yes | Yes |
| Okta (Governance) | Yes | No | No | Yes | Yes |
| Entra ID (P2) | Yes | No | No | Yes | Yes |
| Authentik | No | No | No | Yes* | Yes |
| Keycloak | No | No | No | No | No* |
* = limited or via extension
Authentik Integration Notes
For customer IdPs that an organisation may already use, these are the federation paths to Authentik:
| Customer IdP | Federation Method |
|---|---|
| Entra ID | OIDC or SAML federation; Authentik as SP or IdP |
| Okta | SAML or OIDC federation; SCIM sync |
| OIDC federation; Google as social login source | |
| JumpCloud | SAML federation; LDAP sync via outpost |
| On-prem AD | LDAP sync to Authentik; Kerberos via FreeIPA bridge |
Tools
24 tools.
389 Directory Server
389 Directory Server (389 DS) is an enterprise- grade LDAP server developed by Red Hat as part of the Fedora Project. It is the LDAP backend used by FreeIPA and Red Hat Identity Management (IdM).
License: GPL-3.0-or-later (OSS) · Kind: web · Deploy: native · SSO: none
Auth0
Auth0 is a developer-focused identity platform specializing in customer identity and access management (CIAM).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Authelia
Authelia is an open-source authentication and authorization server designed primarily as a forward-authentication proxy for reverse proxies such as Nginx, Traefik, HAProxy, and Caddy.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Authentik
Authentik is an open-source identity provider and single sign-on platform built with Python (Django) on the backend and Go-based outposts for protocol translation.
License: MIT (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
Azure AD / Entra ID
Microsoft Entra ID (formerly Azure Active Directory) is the cloud-based identity and access management service within the Microsoft ecosystem.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
CyberArk Identity
CyberArk Identity (formerly Idaptive, originally Centrify Identity Services) is a cloud-based workforce identity platform that provides SSO, adaptive MFA, lifecycle management, and endpoint authentication.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ForgeRock
ForgeRock is an enterprise identity platform that provides access management (AM), identity management (IDM), and directory services (DS) as a comprehensive identity suite.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
FreeIPA
FreeIPA (Free Identity, Policy, and Audit) is an integrated identity management solution for Linux and UNIX environments, developed primarily by Red Hat.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
Gluu / Janssen
Gluu is an enterprise identity platform whose open-source Janssen Project core provides a certified OIDC provider, SCIM and FIDO servers, and SAML federation; Gluu Flex is the commercial distribution.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
Google Cloud Identity
Google Cloud Identity is Google’s enterprise identity and device management service. It provides a cloud-hosted directory, SSO via OIDC/SAML, MFA, device management, and security policies.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
IBM Security Verify
IBM Security Verify is IBM’s identity and access management portfolio, encompassing both SaaS and on-premises products.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
JumpCloud
JumpCloud is a cloud-based directory platform that provides unified identity, device, and access management from a single SaaS console.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Kanidm
Kanidm is a modern identity management server written entirely in Rust, designed as a secure, performant alternative to traditional LDAP-based directory services.
License: MPL-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Keycloak
Keycloak is an open-source identity and access management platform developed by Red Hat and donated to the Cloud Native Computing Foundation (CNCF) as an incubating project.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
MidPoint (Evolveum)
MidPoint is an open-source Identity Governance and Administration (IGA) platform developed by Evolveum.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
Okta
Okta is the market-leading cloud identity platform, providing SSO, MFA, lifecycle management, API access management, and identity governance as a SaaS service.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Omada
Omada is a European identity governance and administration (IGA) platform headquartered in Denmark. The platform provides identity lifecycle management, access governance, compliance management, and audit reporting.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
OneLogin
OneLogin is a cloud-based identity and access management platform that provides SSO, MFA, directory integration, and user provisioning.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
OpenLDAP
OpenLDAP is the reference open-source implementation of the Lightweight Directory Access Protocol (LDAP). It has been in development since 1998 and is one of the most widely deployed LDAP servers globally.
License: OLDAP-2.8 (OSS) · Kind: web · Deploy: native · SSO: none
Ory (Kratos / Hydra / Keto)
Ory is a modular, open-source identity infrastructure suite consisting of several independent components: Kratos (identity and user management), Hydra (OAuth 2.0 / OIDC server), Keto (authorization / permissions), and Oathkeeper (API gatewa…
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
Ping Identity
Ping Identity is an enterprise identity platform offering a comprehensive suite of products for SSO, MFA, directory services, API security, and identity verification.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
SailPoint
SailPoint is the market leader in Identity Governance and Administration (IGA), providing identity security solutions focused on access governance, compliance, and lifecycle management.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Saviynt
Saviynt is a cloud-native Identity Governance and Administration (IGA) platform that converges identity governance, privileged access management, application access governance, and third-party access governance into a single cloud service.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Zitadel
Zitadel is a cloud-native identity management platform written in Go, designed for multi-tenant SaaS environments. It provides OIDC, SAML, and SCIM support with a strong focus on developer experience and API-first design.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
