Keycloak has some learning curve, but it’s the best OpenID Connect client and the most configurable and feature rich open source SSO system with the fewest major issues that I’ve used. And I use traefik for a reverse proxy, so for things that don’t support SSO directly thomseddon/traefik-forward-auth works flawlessly with Keycloak to provide an auth layer to those apps.

https://github.com/lldap/lldap is much simpler.

I use Authelia and its worked perfect to put auth in front of my services, including OAuth

If you are not on the warpath with Webauthn I can highly recommend PocketID. It’s just so damn convenient. But note that the arrs don’t come with a good solution for oidc login. But you can use something like tinyauth or an auth forwarder in your reverse proxy. Bitwarden will work fine but of course still require a master key to unlock the vault itself.

I have been using Authentik for several years now, works great with k8s. Not sure about the difference between Keycloak and Authentik tho (feature vise)

I’ve been using Authentik for a while now and it works very well. There is also a Teraform provider to manage it as code. I do mostly OIDC, but also use it as a proxy for a few things that do not support that and just need to be locked down (Esp home and longhorn dashboards for example).

The disadvantage is that it is not the lightest option. If that is important to you, look at Authelia.

I used to love keycloak, but lately they’ve made changes that make client setup feel very complicated. I switched to authentik a while back and I feel it’s far easier to deal with.

For very simple Kubernetes and Docker environments, I’ve used Dex IdP with good results. It’s low on features, but easy to set up.

Keycloak is amazing for no money, I use it connected to my Google workspace.