Open-source alternatives to Okta and Auth0

Once a business has a handful of apps, logins become a real problem. Everyone has too many passwords. Someone leaves, and you can't quite remember everything they had access to. That's what single sign-on fixes: one login, with two-step security, and one place to switch someone off.

Okta and Auth0 are the big names, and they do slightly different jobs, even though Okta owns both. Okta is for your staff logging in to work apps. Starter is $6 per user a month billed annually, about £4.55, with a $1,500 annual contract minimum. So even a small team pays around £1,135 a year.

Auth0 is for adding login to your own software. It has a generous free tier of up to 25,000 monthly active users, then paid plans start at $35 a month for 500 users on B2C or $150 on B2B, and they climb quickly as you grow. B2C Essentials at 10,000 users is $700 a month.

Both of the open-source options below can do either job. Neither costs anything per user on the free edition.

Keycloak

Keycloak is the established heavyweight. It's a Cloud Native Computing Foundation incubation project under the Apache 2.0 licence, and there's no paid edition from the project to worry about.

• Single sign-on and single sign-out across your apps.
• All the main standards: OpenID Connect, OAuth 2.0 and SAML 2.0.
• Social login and identity brokering, so people can sign in through Google or another provider.
• LDAP and Active Directory, to connect an existing staff directory.
• Two-step login, with authenticator apps, recovery codes and passkeys.
• An admin console and a self-service account page.
• Fine-grained permissions, password policies, themes and clustering.

It's very capable, and that's the problem as well. Keycloak is Java-based and needs a separate database, with PostgreSQL the usual choice. Its docs suggest a memory limit of at least 2 GB for smaller production setups, and it expects HTTPS and a proper hostname to run in production mode.

The admin console has a lot of concepts to learn: realms, clients, flows and mappers. For a developer adding login to a customer-facing product, that depth is exactly the point. For a 15-person firm that wants staff to log in to a few apps, it's probably more than you need.

authentik

authentik is the newer option and generally the easier one to live with. It runs with Docker Compose and asks for at least 2 CPU cores and 2 GB of memory.

• A wide range of login types in the free edition: OIDC, SAML, LDAP, RADIUS, SCIM, Kerberos and proxy.
• Proxy login is a handy one. It can put a login in front of older apps that have no single sign-on of their own.
• Two-step login with authenticator apps, security keys and passkeys.
• Flows you can customise, built from stages, so you can decide exactly what happens at login.
• A dashboard where staff can see and open their apps.

It's open core, so read the licence properly. Most of the code is MIT licensed, but the enterprise directory has its own licence. The paid Enterprise plan is $5 per internal user a month or $0.02 per external user, billed annually, and it adds commercial support along with some extra features. Enterprise Plus starts at $20,000 a year. The free edition has no support beyond the community on Discord, and authentik itself describes it as being for homelab users and simple use cases. Take that seriously, because your login system isn't where you want to be on your own at 9am on a Monday.

Which one?

My pick for staff logins in a small business is authentik. The free edition covers the login standards you'll need, and it's easier to run.

• Main drawback: free means community support only, for the one system everything depends on.
• Keycloak instead if you're building login into your own product, or you want no paid edition sitting beside the free one.
• Stay with Okta or Auth0 if you don't have someone technical to run this. Plenty of small firms should pay, and Auth0's free tier is hard to argue with for a new app.
• Google or Microsoft login may also do the job if all your apps support it and you already pay for one of them.

The UK angle

Using a US-owned login provider is fine for most small firms. Okta lists the UK among its locations, and Auth0 offers a UK public cloud region that you pick when creating a tenant. Check which one you're on, because it's chosen up front.

For staff logins, the personal data is fairly limited: names, work emails and login records. It matters more if you're handling customer accounts on your own product, where you'll hold a lot more of it and should know exactly where it sits.

The bigger question with self-hosting isn't where the data is. It's security. A login system holds the keys to everything, and a breach is a very bad day, so you're swapping a vendor's security team for your own patching. Be honest about whether you have someone who'll do that.

Honest drawbacks

• You're now running the front door. If it goes down, nobody can log in to anything, so it needs monitoring, backups and a plan.
• Security updates can't wait. Skipping them on a login server is a real risk.
• Fewer ready-made connectors. Okta has a big catalogue of pre-built app integrations. Here, you'll set up each app yourself using its OIDC or SAML settings.
• Not every app supports single sign-on on cheap plans. Some vendors charge extra for it, so check before you build a plan around it.
• Keycloak has a steep learning curve.
• authentik's free edition has no support. The paid plan may well be worth it.

Need login built into your own software?

If you're adding single sign-on to your own application or connecting older systems, the team at Dev Partners can build and customise that for you.

Sources

• Keycloak home page
• Keycloak Server Administration Guide
• Keycloak: running in containers
• Keycloak: memory and CPU sizing
• authentik LICENSE on GitHub
• authentik pricing
• authentik: Docker Compose install
• authentik: WebAuthn and passkeys
• authentik Enterprise docs
• Okta pricing
• Okta data residency
• Auth0 pricing
• Auth0: UK public cloud region