Rauthy

License	FOSS problems	Maintenance	SSO	Users	Tested
Apache-2.0Permissive license. Like MIT, but each contributor grants users a patent licence covering their contribution, preventing later suits.	—	Active	✅	Unlimited	❌

Description

Rauthy is a self-hosted OpenID Connect (OIDC) and OAuth2 authentication server written in Rust. It lets you run your own identity provider — managing users, sessions, and single sign-on across all your self-hosted apps from one place.

Features

• OIDC and OAuth2 — standard protocols, compatible with most self-hosted apps' existing SSO support.
• Lightweight — small operational footprint compared to a fuller identity platform.
• Security-first design — built with hardening as a first principle, not an afterthought layered on top.

Usage patterns

• Central SSO across self-hosted apps — users authenticate once and gain access to all connected apps without separate accounts per service. A hard dependency if SSO is meant to work at all — without a central identity provider, SSO fields on apps like Forgejo or Outline are just holes.
• Small setups without centralised access needs — for few users and no need for centralised control, per-app accounts are simpler than standing up and maintaining an identity provider.

License and governance

Apache-2.0 — permissive, no restrictions on self-hosting or modification.

Conclusion

Why you would — lightweight, security-first, and a hard requirement if SSO across self-hosted apps is meant to work at all rather than sit as unconnected fields on each app's own login page.

Why you wouldn't — it adds a critical dependency: if Rauthy goes down, nobody can log into anything that relies on it, raising the bar for uptime and monitoring. It also requires understanding OIDC configuration — client IDs, redirect URIs, scopes — which has a real learning curve.