Three lightweight identity providers come up whenever a team wants single sign-on without running Keycloak. They differ in language, licence and how much they assume about your organisation.
authentik
Python and Django, MIT licensed, with an enterprise directory under a separate licence. It speaks OIDC, SAML, LDAP and SCIM, so it can front older applications as well as modern ones. Its brands feature gives each tenant a login domain and branding over one shared user directory, which covers most multi-tenant needs without full isolation.
Zitadel
Written in Go and licensed AGPL-3.0. Multi-tenancy sits in the design: one instance serves many organisations, each with its own projects, roles and login policy. It offers OIDC and SAML, plus a management API for teams that provision users from their own tooling.
Authelia
Go and Apache-2.0. Authelia concentrates on protecting web applications behind a reverse proxy: forward-auth for nginx and Traefik, and an OIDC provider for applications that speak it. One deployment serves one user directory, so treat it as a single-tenant gateway.
Which one
Choose Authelia when you want a login gate in front of a handful of self-hosted apps and you already run a reverse proxy. Choose authentik when you need SAML or LDAP for legacy software alongside OIDC. Choose Zitadel when you host for several organisations and want tenancy built in.
All three run in a container and use a fraction of Keycloak’s memory. Keycloak still wins on protocol breadth and enterprise integrations, and it stays the safer pick when an application demands something unusual, as the site’s Keycloak guides show.