Tootfinder

Ugh why is this always the way. I evaluated like 25 authentication servers for a small scale web project — I do want to support things like OIDC and Passkeys, so this is not something I really want to make myself like the old days of “use crypt() on the passwords and just make a simple database”.
5 of them are just dev mode garbage that will never see the light of day as a thing people use.
2 of them are home network nonsense for people who want enterprise login for their family, but where One Nerd controls the whole user-list.
15 of them are freemium "open source" where they withhold features for their enterprise tier and make them so unfortunately difficult to deploy, all requiring postgresql databases and a complex containerization setup and helm charts and oh so much.
and then there's kanidm, which is great except its opinions make it completely unusable for a community project, it's really more trying to fit the ‘enterprise unix authentication' space. Kudos to them for communicating it but it's the wrong tool, even if it is really good.
And then there's rauthy. Which is exactly what I want, well built and delightful, uses a lightweight embedded database, and even has a peer-to-peer sync for scalability. But customizing it is going to be a lesson in building it from source repeatedly, and its configuration is just a bit strange, and its frontend is extremely Backend Developer Wrote A Web UI. I guess I got a second project. And maybe a third to make debian packages of it.
Yet it really is the best of the options _by far_.
NLNet supported projects continue to punch above their weight class.