Rauthy
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| Apache-2.0Permissive license. Like MIT, but each contributor grants users a patent licence covering their contribution, preventing later suits. | — | Active | ✅ | Unlimited | ❌ |
Evaluation
What it is
Rauthy is a self-hosted OpenID Connect (OIDC) and OAuth2 authentication server written in Rust. It lets you run your own identity provider — managing users, sessions, and single sign-on across all your self-hosted apps from one place.
Why it could be useful
Most self-hosted apps support OIDC login. With Rauthy in place, users authenticate once and gain access to all connected apps without separate accounts per service. It's also a hard dependency if you want SSO to work at all — without a central identity provider, SSO fields on apps like Forgejo or Outline are just holes. Rauthy is lightweight, has a small operational footprint, and is built with security as a first principle.
Why not to go for it
It adds a critical dependency: if Rauthy goes down, nobody can log into anything that relies on it. That raises the bar for uptime and monitoring. It also requires understanding OIDC configuration — client IDs, redirect URIs, scopes — which has a learning curve. For small setups with few users and no need for centralised access control, per-app accounts are simpler.