Keycloak

Keycloak is the enterprise workhorse of open-source identity: OIDC and SAML, user federation against LDAP and Active Directory, fine-grained authorization, realms for multi-tenancy, and years of production hardening under Red Hat's stewardship.

The admin console has improved but remains a place where new users get lost; a JVM footprint and upgrade discipline come with the territory. In exchange, virtually every library and product on earth documents how to integrate with it.

Pick Keycloak when compatibility and longevity trump lightness — or when work experience with it is itself the point.