authentik

authentik was built by developers who found Keycloak's XML-heavy configuration and realm mental model too steep a cost for the organizations that weren't already running a full Red Hat stack. The result is an identity provider that supports the same protocols — OIDC, OAuth 2.0, SAML 2.0, LDAP, RADIUS — but organizes them through a visual flow designer instead of nested admin console screens.

The flow concept is authentik's most distinctive feature. Authentication, enrollment, password reset, and device verification are all defined as sequences of stages — identifier collection, password validation, MFA prompt, user write — that you assemble visually and can branch conditionally. Adding a captcha to failed-login flows or requiring a secondary approval for privileged access is a matter of dragging stages into position rather than writing a provider plugin in Java. That makes customization accessible to engineers who aren't identity specialists.

authentik's community edition is MIT-licensed and free to self-host with no user limits, running comfortably on Docker Compose with a Postgres backend. Enterprise features — full audit logs, dedicated support, and enhanced RBAC — require a commercial license. The stack is Python and Django, which is familiar to a wide range of backend developers but consumes more memory than a Go-based alternative. For teams moving off Auth0 who want Keycloak's capabilities without Keycloak's learning curve, authentik is frequently the recommended middle path.