I have recently looked at this and ended up with KeyCloak (happy I did). Auth0 looked good as a hosted solution. CoreOS dex looks promising, but it's quite early in it's life cycle. I have some experience with Atlassian Crowd as well, which can be used as an openid provider, but is much more limited in features. Cheers, Paul

What are you trying to accomplish? An identity management tool can run the gambit from directory management, sso, identity provider, user management portal, user self service provisioning, etc. Also, the type of applications could matter as well (ie are you looking for a primarily Java or .Net world, SaaS, etc)?

Right now, its more to identify the list of what's out there. I have some good pointers based on this thread, so thanks everyone. On Tue, Aug 9, 2016 at 3:13 PM Marc Boorshtein < marc.boorshtein(a)tremolosecurity.com&gt; wrote:

Hey John, I had to do a bunch of research last year when we were looking for an SSO solution for our apps. Here's a list I came across on Wikipedia at some point which really helped me understand a good range of stuff out there: https://en.wikipedia.org/wiki/List_of_single_sign-on_implementations We landed on Keycloak at the end because it was pretty no nonsense to get off the ground and we were able to get a proof of concept including coding our needed core customizations out the door in about a week. Prior to that, we wasted a lot of time with WSO2 Identity Server, which seemed nice at the start. Unfortunately the documentation was not as good as it looked when it came to many important details, and sadly we learned even though it was open source, that did not apply to the most current security patches. For us, they were touching areas of code we needed to customize or patch (since they weren't totally adherent to SAML standards). So that would've been crazy money for support and maintenance just to get the patch code... aside from that, there were just weird quirks with it consistency-wise. So it was back to hunting and looking into things like OpenAM, Gluu Server, Shibbolth, etc.... then I learned Red Hat had something other than PicketLink... Keycloak crew, you really nailed it. It's been in production for months and totally reliable. Anyway, hope the notes are helpful in someway. jeremy jeremy(a)jeremysimon.com www.JeremySimon.com On Wed, Aug 10, 2016 at 10:51 AM, Bill Burke <bburke(a)redhat.com&gt; wrote: