A self-hosted library and reading platform for ebooks, PDFs, audiobooks, and comics with built-in OpenID Connect login that works with any provider, including Keycloak, Authentik, Authelia, and Pocket ID.
A self-hosted digital library for ebooks, comics, and manga with built-in OpenID Connect login, including automatic account creation and optional role sync for library access and age restrictions.
A self-hosted bookmark-everything app for links, notes, and images with AI tagging that supports OIDC-compliant providers through its built-in OAuth configuration.
An open-source self-hosted ERP suite whose underlying Frappe framework provides free OpenID Connect login through Social Login Keys, including Keycloak and custom OIDC providers.
A self-hosted Docker management platform with OIDC/SSO login and MFA included free in every tier (LDAP and RBAC are the paid Enterprise add-ons), though its BSL 1.1 license is not open source.
A build and deployment system managing unlimited hosts based on Docker Compose and optionally Swarm with built-in OAuth2 authentication that works with any OIDC provider.
A container management UI for Docker and Kubernetes with built-in OAuth2 authentication that works with any OIDC provider via the custom provider settings.
A self-hosted dashboard for managing apps and servers that supports signing in through external OpenID Connect providers with group-based permission mapping.
An open-source self-hosted platform for provisioning cloud development environments with OIDC authentication, claims mapping, and optional refresh tokens.
An open-source backend in a single binary with built-in OpenID Connect authentication, including multiple OIDC providers and optional id_token signature validation.
A self-hosted authoritative and recursive DNS server with ad and malware blocking whose web console supports Single Sign-On login through OpenID Connect providers, with group-to-role mapping. Configured via the Administration > SSO tab or DNS_SERVER_SSO_* environment variables.
A self-hosted collaborative knowledge base with an OIDC authentication plugin. OIDC is available without an SSO add-on, but the current BSL license has restrictions and is not an open-source license.
A self-hosted file-transfer platform with built-in OAuth2/OIDC login for generic OIDC providers, plus optional automatic account creation for users signing in through a trusted provider.
The actively maintained fork of the archived Pingvin Share file-sharing platform, carrying on its OpenID Connect and LDAP authentication alongside local accounts.
An end-to-end-encrypted collaborative office suite whose self-hosted instance can delegate account creation and login to OpenID Connect identity providers.
An open-source file sync and sharing platform that authenticates users via OpenID Connect using its embedded identity provider or an external one such as Keycloak.
The classic PHP-based ownCloud Server file sync and sharing platform, which gains OpenID Connect login through its free and open-source openidconnect app for any external identity provider.
A self-hosted file sync and sharing platform written in Go that authenticates users through OpenID Connect using its embedded identity provider or an external one such as Keycloak.
A self-hosted game distribution platform for LAN parties and private networks whose server can delegate sign-in to external OpenID Connect (or OAuth2) identity providers alongside its built-in local accounts.
A self-hosted ROM library manager with metadata scraping that supports any OpenID Connect provider, including auto-provisioning, role mapping, and SSO-only login.
A self-hosted game server management panel with free OAuth login and a first-party generic OIDC plugin that supports any custom OpenID Connect provider.
A platform for authoring, scheduling, and monitoring workflows that supports OAuth and OpenID authentication through its Flask-AppBuilder auth provider.
A container-native continuous integration system with a built-in generic OpenID Connect auth connector that only needs an issuer URL and supports per-team user and group authorization.
MIT (Community Edition) / GitLab Enterprise Edition license
A self-hosted DevOps platform with OpenID Connect OmniAuth login available in the Free self-managed tier; advanced OIDC group-based administration requires higher tiers.
A self-hosted Git server with code review and CI that includes OpenID Connect single sign-on in its free Community Edition, with group-based authorization via claims.
A privacy-first, self-hosted menstrual cycle tracker with optional OIDC sign-in in hybrid or SSO-only mode, guarded owner auto-provision, and provider logout.
A self-hosted food, fitness, water, and health tracker for families that supports multiple OpenID Connect providers configured through its admin UI, with optional automatic user registration.
A Kubernetes web UI that supports logging in through OpenID Connect, both in-cluster via the API server OIDC configuration and with static OIDC credentials.
A self-hosted media server for movies, TV, and music with built-in OpenID Connect login, optional automatic account creation, and explicit account linking.
A self-hosted real-time push message server (v3.0 and up) with OIDC login, auto-registration, and group-based admin mapping; the identity provider must support PKCE.
A lightweight self-hosted ActivityPub server with built-in OpenID Connect login, group-based admin rights, and support for providers such as Dex, Keycloak, and GitLab.
Decentralized social network server with OmniAuth support for OpenID Connect identity providers, allowing users to sign in with an external SSO account.
A self-hosted, open-source note-taking app (alternative to Notion, Obsidian, or Evernote) with built-in OpenID Connect login (authorization code + PKCE), auto-provisioning, group-based access control, and an optional SSO-only mode.
A self-hosted alert monitoring and dashboard tool for consolidating alerts from multiple sources, with generic OpenID Connect authentication and role and group claims.
The open-source Grafana distribution supports OIDC-compatible providers through Generic OAuth; some provisioning and enterprise capabilities are separate features.
A self-hosted monitoring platform for Proxmox, Docker, Kubernetes, and TrueNAS with OIDC single sign-on, group and domain restrictions, and claim mapping.
A fast, privacy-focused envelope budgeting app whose self-hosted server supports signing in through an OpenID Connect (or generic OAuth2) provider, the recommended setup for multiple users.
A self-hosted personal finance app for tracking budgets, goals, and transactions (a Mint alternative) that can authenticate users through an external OpenID Connect identity provider instead of local accounts.
A self-hosted wealth management tracker for portfolios and assets with experimental OpenID Connect sign-in via issuer discovery and configurable scopes.
A no-budget, multi-currency personal finance tracker with a built-in dollar-cost averaging tracker whose login can be delegated to an external OpenID Connect provider via django-allauth, configured through environment variables.
A self-hosted task, project, and notes manager with OIDC single sign-on for providers such as Google, Okta, Keycloak, Authentik, PocketID, and Azure AD, including automatic account provisioning.
A self-hosted grocery list and recipe manager whose backend accepts a generic OpenID Connect provider with account linking and mobile app redirect support.
A realtime, self-hosted recipe app for families and friends with OpenID Connect single sign-on, claim-based group mapping for admin and household roles, and configurable scopes.
A self-hosted recipe manager and meal planner that supports a generic OpenID Connect provider and many other OAuth logins via django-allauth social authentication.
A self-hosted Tailscale-compatible mesh VPN control server with OpenID Connect login, automatic configuration via discovery, and user filtering by domain, email, or group.
A self-hosted, identity-aware tunneled reverse proxy and WireGuard-based remote access platform that authenticates users through external OpenID Connect identity providers such as Authentik, Keycloak, or Entra ID.
An open-source bastion and access gateway for SSH, HTTPS, Kubernetes, databases, RDP, and VNC with built-in OpenID Connect SSO, role-based access control, and session auditing.
A self-hosted, browser-based SSH terminal and remote desktop (RDP/VNC) management platform with built-in OIDC, LDAP, GitHub, and Google sign-in, OIDC group-to-role mapping, and 2FA.
A CNCF sandbox reverse proxy and middleware that authenticates users against any OpenID Connect provider and forwards identity headers to upstream applications.
A self-hosted identity-aware access proxy for infrastructure whose OpenID Connect auth method lets users sign in through any compliant identity provider.
A self-hosted secrets and identity platform whose JWT/OIDC auth method provides browser-based OpenID Connect login for the UI and CLI in the free self-hosted edition.
A self-hosted social publishing platform for composing, adapting, scheduling, and tracking posts across multiple social networks, with built-in optional OpenID Connect login through a configurable instance-wide identity provider.
MIT (Community Edition) / commercial licenses for enterprise packages
A self-hosted team chat platform whose community edition includes configurable custom OAuth providers that work with any OpenID Connect identity provider.
A self-hosted, open-source personal flight-tracking system with built-in OIDC/OAuth2 single sign-on configurable in the settings UI or via environment variables, including auto-registration and SSO-only login.
A self-hosted location-history tracker (a Google Timeline alternative) that supports OpenID Connect sign-in with discovery or manual endpoints, auto-registration, account linking, and optional PKCE.
A self-hosted travel and trip planner with real-time collaboration, interactive maps, budgets, and packing lists, plus built-in OpenID Connect single sign-on with discovery, PKCE, id_token verification, automatic account creation, and an SSO-only login mode.
A self-hosted network source-of-truth and automation platform with out-of-the-box single sign-on via OpenID Connect or SAML through python-social-auth.
An open-source DCIM and IPAM platform for documenting networks and datacenters, with single sign-on through any python-social-auth backend including generic OpenID Connect.
A self-hosted Linux patch management and fleet automation platform with OpenID Connect single sign-on, including automatic user provisioning, group-to-role mapping, and SSO-only enforcement.
These applications were considered but do not meet the admission criterion: the free self-hosted edition must support OIDC login without a paid SSO add-on. Editions and plans change, so re-check before relying on any of these.
The edition with full SSO features is proprietary and only free for up to 3 nodes for non-commercial use; the open-source Portainer CE is listed instead.
OAuth2/OIDC single sign-on requires a paid Server-tier license and SAML requires the Enterprise tier; the free open-source edition does not include SSO.
LibreChat
Open WebUI
Matomo
Audiobookshelf
BookOrbit
Grimmory
Karakeep
Linkding
Linkwarden
ERPNext
Apache Superset
Directus
Drupal
WordPress
Discourse
Arcane
Dockhand
Komodo
Portainer CE
Harbor
Homarr
Homepage by gethomepage
Penpot
Coder
PocketBase
Temporal UI
Technitium DNS Server
Paperless-ngx
BookStack
HedgeDoc
MediaWiki
Outline
Wiki.js
XWiki
Moodle
Erugo
Pingvin Share X
CryptPad
Nextcloud
OpenCloud
ownCloud Classic
OxiCloud
Gameyfin
LANCommander
RomM
Calagopus
Pelican
Apache Airflow
Argo Workflows
Argo CD
Concourse
Forgejo
Gitea
GitLab Self-Managed
Jenkins
SparkyFitness
Zammad
Rancher
Weblate
Budibase
K7
Gotify
Mastodon
Matrix Synapse
JupyterHub
Listmonk
Memos
Poznote
Trilium Notes
Beszel
Grafana OSS
Pulse
Uptimekit
Vaultwarden
Actual Budget
Budget Board
Ghostfolio
Homebox
VoucherVault
WYGIWYH
Immich
PhotoPrism
Leantime
Redmine
Tududi
Vikunja
Windshift
KitchenOwl
Mealie
Norish
Tandoor Recipes
Firezone
NetBird
Pangolin
Warpgate
Apache Guacamole
Termix
Pomerium
FreshRSS
OpenSearch Dashboards
HashiCorp Vault
OpenBao
OpenPost
Rocket.Chat
Zulip
AirTrail
Dawarich
Trek
Trip
Greenlight (BigBlueButton)
PatchMon
Proxmox VE