Authentik

Free: The MIT-licensed open source edition includes SAML, OAuth2/OIDC (OpenID Certified), LDAP, SCIM, RADIUS, Kerberos and proxy providers, web-based RDP/SSH access, MFA (TOTP, WebAuthn/passkeys, Duo, SMS, email, static codes), customizable flows for login, enrollment and recovery, and B2B and B2C use cases. Support is community only (Discord and GitHub issues). There is no hosted version: authentik says it does not offer one.

Self-hosted: Docker Compose (Postgres, server, worker) for test and small production setups; Helm on Kubernetes for larger ones; official AWS CloudFormation templates and a DigitalOcean Marketplace app. Docs require at least 2 CPU cores and 2 GB of RAM. Redis was removed in 2025.10, so Postgres carries caching and tasks (expect roughly 50% more Postgres connections). LDAP, proxy, RADIUS and RAC providers run through outposts, a separate authentik component. Enterprise uses the same images: you install a license key, validated locally, so it works air-gapped.

Paid: Enterprise is $5 per internal user per month and $0.02 per external user per month, billed annually; service and agent accounts are free. It adds privileged access management, agent accounts, Google Workspace and Microsoft Entra ID sync, client certificate (mTLS, smart card) login, Chrome Enterprise Device Trust, Shared Signals Framework, password history checks, enhanced audit logging, scheduled offboarding, Windows local device login, event maps, CSV exports and RADIUS EAP-TLS. Ticket-based support only applies to subscriptions over $1k a year. Enterprise Plus starts at $20k annually for invoice billing, SLAs, volume discounts, multi-instance support and FIPS for FedRAMP. Exceeding licensed capacity triggers warnings and, after six weeks, read-only admin mode (logins keep working). For reference, Okta's Workforce suites start at $6 per user/month billed annually with a $1,500 annual contract minimum.