I like Pocket ID. It's also very simple to set up and just works™

https://pocket-id.org/

I use Authelia. I found it pretty easy to set up. They even provide guides with examples on how to integrate with other applications. For instance, I use Traefik for my reverse proxy: Traefik | Integration | Authelia

You can use a simple YAML file for your IdP or LDAP if you need more than a handful of users.

What's the difficulty with keycloak? I just set this up last weekend

https://oneuptime.com/blog/post/2026-03-18-run-keycloak-podman-container/view

I honestly didn't find authentik very complicated. You can be up and running pretty much after starting it. I used docker to run it.

I just setup authentik in podman quadlet and got a lot of my services setup with it. Their documentation is actually very good and thorough. It covers a ton of services with easy to follow instructions.

Protocol-wise, OIDC is generally the most supported out there. LDAP too, to an extent.

Software wise, I find Kanidm quite simple to set up (basically just one container). It's mostly managed via the terminal though, and lacks some eyecandy. But some of the examples in its docs should be easy to follow and get you familiar with mapping scopes/groups between Kanidm and services.

Authelia is okay too

Void auth, or kanidm look like easier alternatives.

https://github.com/lldap/lldap

Or maybe: https://gitlab.com/yaal/canaille

I already have Forgejo installed and found out it does basic Oauth2. I didn't have to do anything. It just worked out of the box.

Oidc is easier to implement than SAML. Oauth2 is for authorization (vs authentication). Its used along with Oidc, but Oidc is the authentication piece (the SSO part)

I say Oidc is easier to implement because it is json based (jwt token) vs SAML which uses XML, which is very verbose and has stuff like namespaces and xsd’s which can make XML a pain to work with.

I’d suggest you stick to keycloak and set up Oidc. This is a good tutorial https://medium.com/@buffetbenjamin/keycloak-essentials-openid-connect-c7fa87d3129d

Edit: take a look at authentik too. I’ve always used keycloak but authentik looks interesting

I’ve gone with Authentik for my homelab, and sure there is some learning to do, but it is fairly simple once it’s setup, and in the end it is not that bad.

If I were to choose over, I’d god with KeyCloak as it seems like that’s almost exclusively what’s used in the marked ~ and thus would be good to know in depth

I tried several and I found casdoor pretty painless.

.htaccess files are pretty simple to set up, if not hosting anything too sensitive.