Keycloak offers an open source identity and access management solution. It's the upstream for RedHat IdM.
It seems fairly comprehensive as:
- able to connect to a LDAP
- expose a LDAP to help applications to authenticate users
- offer SAML, a more modern way to do so
- expose OIDC (OpenID connect)
The scope of evaluation would be:
- do we need our own LDAP? (probably so not to be vendor-locked)
- how to install and secure Keycloak?
- how to connect applications and services to Keycloak?
- can Keycloak be a source of truth for SSH keys? Is that desirable?
- what UI do we expose to end users? Keycloak directly? an UI linked to Keycloak API? An UI linked to a LDAP or database, independent of Keycloak (not to be vendor-locked)?
- how to manage multiple accounts?
Keycloak official site: https://www.keycloak.org/