Kanidm

Kanidm is an identity management server written in Rust that acts as a single source of truth for accounts, authentication and authorisation. Its goal is to be a complete identity provider: the project says you should not need other components such as Keycloak when you use it. It relies on strict defaults, simple configuration and self-healing components, and targets everything from home labs and families to larger organisations.

On the web side it is an OAuth2/OIDC provider with passkey (WebAuthn) login, an application portal and user self-service in a web UI. Beyond the web it integrates with Linux and UNIX hosts, including offline authentication, distributes SSH keys, provides RADIUS for network and VPN login, and exposes a read-only LDAPS gateway for older software. Administration is done with complete CLI tooling.

Its security model gives each device its own scoped credentials (SSH keys, application passwords, RADIUS passwords), so a compromised device or service can be revoked on its own. Kanidm is free and self-hosted, uses its own database with replication rather than an external SQL server, and does not target customer sign-up flows for public apps.