Open Source Authentication in 2026: Complete Comparison

Last updated: July 2026

Keycloak is the best open source authentication server for most production teams in 2026: it is the only project that combines mature SAML, LDAP federation, and deep customization under a genuine Apache 2.0 license. authentik wins for forward auth and small-to-mid deployments, Zitadel for multi-tenant B2B SaaS (now AGPL-3.0 licensed), Ory for API-first teams building their own UI, and Authelia for the lightest possible self-hosted SSO. FusionAuth is a capable product, but it is not open source.

Every version number, star count, and license claim in this comparison was checked against the GitHub API and each project’s own release notes on July 17, 2026. That matters more than it should, because most “open source auth” comparisons you will find right now repeat two errors: they still list Zitadel as Apache 2.0, and they call FusionAuth open source. Neither is true. Let’s start with the receipts.

Two license facts most comparisons get wrong

Zitadel moved from Apache 2.0 to AGPL-3.0

With the v3 release in March 2025, Zitadel relicensed its core from Apache 2.0 to AGPL-3.0. The APIs, SDKs, and protocol definitions remain Apache 2.0, so building an application against Zitadel does not pull your code into AGPL territory.

For most self-hosters this changes nothing in practice. It matters if you embed Zitadel in a product you distribute, offer it as a service with modifications, or work somewhere with a blanket no-AGPL policy (plenty of enterprises have one). Either way, you should know before you commit, and a surprising number of 2026 comparisons still print “Apache 2.0” next to Zitadel’s name.

FusionAuth is not open source at all

FusionAuth shows up in nearly every “open source authentication” listicle, and it does not belong there. Its free Community tier is licensed as “Free-Tier Software” under a commercial license. You can download it and run it without paying, which is genuinely useful, but you cannot read the source, modify it, or redistribute it. That is free as in beer, not free as in freedom.

We include FusionAuth below because you will evaluate it anyway, and it deserves a fair look. It just needs the right label.

How the eight projects compare (July 2026)

Version and star data throughout this post were pulled from the GitHub API and each project’s release pages on July 17, 2026. Star counts are rounded; treat them as a rough popularity signal, not a quality score.

Keycloak: the enterprise default

Keycloak 26.7.0 shipped on July 9, 2026, and the project sits at roughly 36,000 GitHub stars as of July 2026, the largest community in this list. It is Apache-2.0 licensed, CNCF incubating, and backed by Red Hat, which is about as safe as open source governance gets.

Feature-wise, nothing else here matches it. Full OIDC and SAML 2.0 on both sides (identity provider and broker), LDAP and Active Directory federation, fine-grained authorization, custom authentication flows, and a Java SPI system that lets you override almost any behavior. As of 26.7, SCIM support is a native preview feature behind the scim-api feature flag, so the old advice that you need a third-party extension for SCIM is out of date.

Now the honest part. Keycloak is the heaviest deployment in this comparison next to Ory’s multi-service setup. It runs on the JVM via Quarkus, requires an external relational database (PostgreSQL is the recommendation), and clusters through embedded Infinispan. That is real operational surface compared to a Go binary with SQLite. If you are new to it, start with our complete Keycloak guide, and use the Docker Compose generator to get a sane production-shaped config in minutes.

Best for: enterprise SAML and LDAP requirements, and teams that need to customize deeply.

authentik: forward auth with visual flows

authentik released 2026.5.5 on July 15, 2026, and holds around 22,000 GitHub stars as of July 2026. The core is MIT licensed, with one caveat worth knowing: the repository’s enterprise/ directory ships under a separate license. That is a clean, clearly marked open-core split, but “MIT” alone oversells it slightly.

Architecturally it is a Python (Django) server with Go “outposts” for proxying, and it needs both PostgreSQL and Redis. Two required dependencies is a heavier footprint than the single-binary crowd, though still far lighter to operate than Keycloak. What you get for it: a native SAML IdP, an LDAP outpost that exposes your directory to legacy apps, SCIM provisioning, and a visual flow designer that makes complex authentication logic approachable without writing code. It is backed by Authentik Security Inc., so there is a company behind the project.

The forward-auth outpost mode is the standout. If you are protecting a stack of internal apps that cannot speak OIDC natively, authentik handles it better than almost anything. For a deeper head-to-head, see our Keycloak vs authentik comparison.

Best for: forward auth and homelab-to-SMB deployments where visual flows beat writing Java.

Zitadel: built for multi-tenant B2B SaaS

Zitadel v4.16.1 landed on July 17, 2026 (yes, the day we checked), with around 14,000 GitHub stars as of July 2026. As covered above, the core has been AGPL-3.0 since v3 in March 2025, with APIs and SDKs staying Apache 2.0.

It is a single Go binary backed by PostgreSQL, with an event-sourced architecture that gives you a complete audit trail for free. Its organizations-and-projects model was designed for B2B multi-tenancy from day one, which is why it is the default recommendation when a SaaS needs each customer to bring their own IdP. It ships a native SAML IdP, and the company raised a $9M Series A in November 2024, so it has commercial runway behind it.

Trade-offs: the event-sourced model is elegant but harder to reason about when something goes wrong, there is no built-in LDAP federation, and the AGPL question needs a pass through your legal or procurement checklist before you build on it.

Best for: multi-tenant B2B SaaS where per-customer organizations are the core requirement.

Ory Hydra and Kratos: bring your own everything

Ory moved its projects onto a unified release train, with v26.2.0 shipping in March 2026. Hydra (the OAuth 2.0 and OIDC server) has roughly 17,000 stars and Kratos (identity and self-service flows) roughly 14,000 as of July 2026, all Apache-2.0.

Ory is the composable option: separate Go services, your choice of database, and no login UI at all. You build your own screens against Kratos’s flow APIs, which is either the whole point or a dealbreaker depending on your team. Hydra is OpenID-certified, which few open source servers can claim. Kratos has grown SP-side SAML login (your users can sign in through an upstream SAML IdP) and SCIM support, but there is still no SAML IdP: Ory cannot act as the SAML provider your enterprise customers federate into.

The operational cost is real. You are wiring multiple services, a database, and a UI you wrote yourself. Teams that want infrastructure-grade auth primitives love it. Teams that want a login page by Friday do not.

Best for: API-first teams with the engineering budget to build and own their entire auth UI.

FusionAuth: free download, closed source

FusionAuth 1.68.0 shipped June 30, 2026. It is a single Java application backed by a relational database, and it is genuinely easy to stand up: one app, one database, sensible defaults, good docs.

The catch is the one we opened with: it is not open source. The free Community tier is proprietary software you are licensed to run, not code you can inspect or fork. If your requirement is “no license fees for a self-hosted IdP,” FusionAuth qualifies. If your requirement is “open source so we can audit it, patch it, and never get stranded,” it does not, and no amount of listicle placement changes that.

Judged purely as software, it covers OIDC, OAuth 2.0, and SAML, and its developer documentation is among the best in the category.

Best for: teams that want free-as-in-beer downloadable auth with a commercial company behind it, and who have made peace with the license.

Authelia: the featherweight

Authelia v4.39.20 (May 2026) is the surprise of this list: roughly 28,000 GitHub stars as of July 2026, second only to Keycloak, on a project that deliberately does less. It is Apache-2.0, a single Go binary, and runs happily on SQLite for small deployments or PostgreSQL for bigger ones.

Authelia is a forward-auth companion for reverse proxies (Traefik, nginx, Caddy) that grew into a proper OpenID Connect provider, earning OpenID certification in March 2026. Memory use is measured in tens of megabytes, which is why it owns the homelab and edge-deployment niche.

The hard limit: no SAML, full stop. A SAML 2.0 IdP is on the roadmap but sits in the planning stage as of July 2026. There is also no user federation and no multi-tenancy. That is not criticism, it is scope: Authelia is the lightest way to put SSO and 2FA in front of a set of apps, and it does not pretend to be more.

Best for: lightweight forward auth and OIDC SSO where a full IAM platform would be overkill.

Casdoor: the protocol collector

Casdoor v3.119.0 (July 2026) holds around 14,000 GitHub stars as of July 2026 under Apache-2.0. It is a single Go binary with a React admin UI, and it runs on MySQL, PostgreSQL, or SQLite.

Its protocol spread is unusually wide: OIDC, SAML, CAS, and SCIM in one lightweight package. Its social-login catalog is the broadest of any project here, including providers the Western tools ignore, like WeChat, DingTalk, and Lark. Release velocity is very high; v3.119.0 says something about how often this project ships.

The trade-offs are community and polish. Outside China the contributor and user base is small, documentation quality is uneven (much of it translated), and the enterprise features are shallow compared to Keycloak: no LDAP federation and limited fine-grained authorization.

Best for: broad social login coverage, especially Chinese providers, on a small footprint.

SuperTokens: auth that lives inside your app

SuperTokens core v12.0.7 (July 2026) sits at roughly 15,000 GitHub stars as of July 2026. The core is Apache-2.0 with an ee/ directory carve-out for paid features, the same open-core pattern as authentik. The core service is Java, backed by PostgreSQL, and the real product surface is the SDKs: frontend and backend libraries that embed login, sessions, and account flows directly into your application rather than redirecting to a hosted IdP.

That embedded model is why consumer product teams pick it. Prebuilt UI components get you a polished sign-in experience quickly, and session management is a first-class feature rather than an afterthought.

The boundary is enterprise federation. SuperTokens speaks OIDC and OAuth only; SAML requires bridging through BoxyHQ’s SAML Jackson. The moment “our customer wants to federate their Okta via SAML” appears in your inbox, you have outgrown it.

Best for: embeddable consumer auth where login should feel like part of your app, not a detour.

Which open source authentication server should you choose?

Match the tool to the job, not the star count:

• Enterprise customers demand SAML and Active Directory: Keycloak. Nothing else here has federation this deep under a true open source license.
• A stack of internal apps behind a reverse proxy: Authelia if you want minimal, authentik if you want flows, LDAP, and SCIM too.
• Multi-tenant B2B SaaS: Zitadel, assuming AGPL-3.0 clears your legal review. Keycloak’s organizations feature is the Apache-licensed alternative.
• You are building your own auth UI on APIs: Ory Hydra and Kratos.
• Consumer app, auth embedded in your product: SuperTokens.
• Widest social login, including WeChat and DingTalk: Casdoor.
• Free self-hosted auth and the license does not bother you: FusionAuth, eyes open.
• You would rather not run any of this yourself: compare the managed options in our IdaaS powerhouses roundup.

Where Skycloak stands in all this

Full disclosure: Skycloak sells managed Keycloak hosting, which means we win when Keycloak wins. That is precisely why the license and deployment facts above are straight. A comparison that fudges Zitadel’s relicense or FusionAuth’s terms would not survive contact with the first reader who checks, and honest is a better long-term strategy than clever.

So, honestly: if you are protecting a homelab, run Authelia and keep your money. If you are embedding consumer auth, SuperTokens will treat you well. But if you need enterprise single sign-on with SAML, LDAP federation, and room to customize, Keycloak is the right call, and the main argument against it is operational weight. That is the part we remove. Our pricing is public if you want to see what handing off the ops actually costs.

Frequently asked questions

What is the best open source authentication server in 2026?

Keycloak, for most production use cases. As of July 2026 it pairs the largest community (roughly 36,000 GitHub stars) with the most complete protocol support under Apache 2.0, including full SAML and LDAP federation. The honest exceptions: Zitadel for multi-tenant B2B SaaS, authentik for forward auth, and Authelia when you want the smallest possible footprint.

Is FusionAuth open source?

No. FusionAuth’s free Community tier is “Free-Tier Software” under a commercial license, per its published license terms. You can run it without paying, but you cannot inspect, modify, or redistribute the source. It is a free download, not open source software.

Which open source identity providers support SAML natively?

Keycloak, authentik, Zitadel, and Casdoor all act as native SAML identity providers as of July 2026. Ory Kratos supports SAML only on the service-provider side (logging users in via an upstream IdP), Authelia has no SAML at all yet, and SuperTokens needs BoxyHQ’s SAML Jackson as a bridge. If you are debugging assertions from any of them, our free SAML decoder helps.

Is Zitadel still Apache 2.0 licensed?

No. Zitadel’s core moved to AGPL-3.0 with the v3 release in March 2025, and v4 remains AGPL-3.0. The APIs, SDKs, and protocol definitions stay Apache 2.0, so applications that integrate with Zitadel are unaffected. The change mainly matters if you redistribute or embed Zitadel itself, or if your company prohibits AGPL dependencies.

What is the lightest open source SSO to self-host?

Authelia. It is a single Go binary that can run on SQLite, typically consuming tens of megabytes of memory, and it became an OpenID-certified OIDC provider in March 2026. The constraint is protocol coverage: no SAML and no user federation. If you need SAML on a small footprint, Casdoor is the next-lightest option.