I like Pocket ID. It's also very simple to set up and just works™

https://pocket-id.org/

Protocol-wise, OIDC is generally the most supported out there. LDAP too, to an extent.

Software wise, I find Kanidm quite simple to set up (basically just one container). It's mostly managed via the terminal though, and lacks some eyecandy. But some of the examples in its docs should be easy to follow and get you familiar with mapping scopes/groups between Kanidm and services.

Authelia is okay too

What's the difficulty with keycloak? I just set this up last weekend

https://oneuptime.com/blog/post/2026-03-18-run-keycloak-podman-container/view

I just setup authentik in podman quadlet and got a lot of my services setup with it. Their documentation is actually very good and thorough. It covers a ton of services with easy to follow instructions.

I’ve gone with Authentik for my homelab, and sure there is some learning to do, but it is fairly simple once it’s setup, and in the end it is not that bad.

If I were to choose over, I’d god with KeyCloak as it seems like that’s almost exclusively what’s used in the marked ~ and thus would be good to know in depth

I honestly didn't find authentik very complicated. You can be up and running pretty much after starting it. I used docker to run it.

I use Authelia. I found it pretty easy to set up. They even provide guides with examples on how to integrate with other applications. For instance, I use Traefik for my reverse proxy: Traefik | Integration | Authelia

You can use a simple YAML file for your IdP or LDAP if you need more than a handful of users.

I already have Forgejo installed and found out it does basic Oauth2. I didn't have to do anything. It just worked out of the box.

.htaccess files are pretty simple to set up, if not hosting anything too sensitive.