function: authorization
504 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| yudao (ruoyi-vue-pro) Yudao (ruoyi-vue-pro) is an open-source rapid development platform and admin management system built on Spring Boot, MyBatis Plus, and Vue/… | 97 | 38991 | active |
| Keycloak Keycloak is an open-source identity and access management service providing single sign-on, user federation, and fine-grained authorization… | 99 | 36431 | stable |
| Hasura GraphQL Engine Hasura GraphQL Engine is an open-source engine that auto-generates instant, realtime GraphQL APIs (and REST endpoints) over existing databa… | 98 | 32098 | active |
| jumpserver/jumpserver JumpServer is an open-source Privileged Access Management (PAM) platform and bastion host that provides secure, audited access to SSH, RDP,… | 99 | 31455 | stable |
| better-auth/better-auth Better Auth is a framework-agnostic authentication and authorization framework for TypeScript that ships with comprehensive features like e… | 87 | 29706 | active |
| authelia/authelia Authelia is an open-source authentication and authorization server and portal providing single sign-on (SSO) and multi-factor authenticatio… | 95 | 28712 | active |
| rancher/rancher Rancher is an open-source container management platform for deploying and operating Kubernetes clusters across datacenters, clouds, and edg… | 95 | 25873 | stable |
| goauthentik/authentik authentik is an open-source Identity Provider (IdP) and Single Sign-On (SSO) platform supporting SAML, OAuth2/OIDC, LDAP, SCIM, RADIUS, and… | 95 | 25178 | active |
| gravitational/teleport Teleport is an identity-aware access proxy and certificate authority that provides unified, credential-free access to SSH servers, Kubernet… | 93 | 20852 | stable |
| apache/casbin Apache Casbin is an open-source authorization library that enforces access control using models such as ACL, RBAC, ABAC, ReBAC, and MAC, de… | 98 | 20349 | stable |
| dromara/Sa-Token Sa-Token is a lightweight, open-source Java authentication and authorization framework covering login authentication, permission checks, di… | 95 | 19005 | stable |
| tiann/KernelSU KernelSU is a kernel-based root solution for Android that runs inside the Linux kernel to grant root access. It provides stealthy, permissi… | 91 | 18014 | active |
| ory/hydra Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider server written in Go, handling token issuance, client management, an… | 78 | 17498 | stable |
| zitadel/zitadel ZITADEL is an open-source identity and access management (IAM) platform providing authentication and authorization out of the box, includin… | 95 | 14864 | active |
| ABP Framework ABP Framework is an open-source, opinionated application framework for building enterprise web applications on .NET and ASP.NET Core. It pr… | 98 | 14417 | active |
| casdoor/casdoor Casdoor is an open-source, self-hosted Identity and Access Management (IAM) and single sign-on (SSO) platform with a web UI, written in Go.… | 95 | 14276 | active |
| spatie/laravel-permission A Laravel package that lets you associate users (and other Eloquent models) with roles and permissions stored in the database. Permissions … | 96 | 12964 | stable |
| go-admin go-admin is a front-end/back-end separated admin management system scaffold built on Gin (Go) and Vue 3 with Element UI, Arco Design, and A… | 88 | 12751 | active |
| open-policy-agent/opa Open Policy Agent (OPA) is a general-purpose, open-source policy engine that unifies policy enforcement across the stack using a high-level… | 99 | 12164 | stable |
| apereo/cas Apereo CAS is an enterprise open-source identity provider and single sign-on server implemented in Java on Spring Boot. It centralizes auth… | 99 | 11360 | stable |
| dexidp/dex Dex is a federated OpenID Connect (OIDC) and OAuth 2.0 identity provider that issues signed ID tokens (JWTs) for applications. It acts as a… | 86 | 11062 | stable |
| pennersr/django-allauth django-allauth is an integrated set of Django applications covering authentication, registration, account management, and third-party (soci… | 76 | 10375 | stable |
| spring-projects/spring-security Spring Security is a powerful and highly customizable authentication and access-control framework for Java applications, and the de-facto s… | 99 | 9612 | stable |
| pocket-id/pocket-id Pocket ID is a self-hosted, OpenID Connect Certified identity provider that lets users sign in to applications using passkeys instead of pa… | 85 | 9029 | active |
| teamhanko/hanko Hanko is an open-source authentication and user management platform built in Go, offering passwords, passkeys (WebAuthn/FIDO2), MFA, OAuth … | 94 | 9015 | active |
| SoftwareBrothers/adminjs AdminJS is an open-source admin panel library for Node.js applications that auto-generates a customizable React-based admin UI from your da… | 44 | 8981 | active |
| sitaramc/gitolite Gitolite is a self-hosted Git repository hosting tool for Unix servers that provides fine-grained, file-based access control over repositor… | 75 | 8588 | stable |
| varvet/pundit Pundit is a Ruby gem that provides minimal authorization for Rails applications using plain Ruby policy classes and object-oriented design.… | 75 | 8522 | stable |
| tinyauthapp/tinyauth Tinyauth is a lightweight, OpenID Certified™ authentication and authorization server written in Go, shipped as a single static binary. It w… | 86 | 8174 | active |
| Solid Solid is a set of open standards and tools for building decentralized web applications where users store their data in personal online data… | 10 | 8093 | active |
| warp-tech/warpgate Warpgate is an open-source, clientless bastion host and privileged access management (PAM) tool written in Rust that transparently proxies … | 99 | 7726 | active |
| stalniy/casl CASL is an isomorphic JavaScript authorization library that restricts what resources a user is allowed to access, using declarative rules t… | 98 | 7055 | stable |
| authzed/spicedb SpiceDB is an open-source, Google Zanzibar-inspired database for storing, computing, and validating fine-grained authorization data at scal… | 99 | 6990 | stable |
| hexclave/hexclave Open-source user infrastructure platform handling authentication, teams, RBAC, payments, emails, and analytics for SaaS apps. Deployable as… | 88 | 6841 | active |
| pig-mesh/pig Pig is an enterprise-grade RBAC rapid development platform built on Spring Cloud, Spring Boot 4, and OAuth2 (Spring Authorization Server), … | 86 | 6675 | active |
| lanyulei/ferry Ferry is an open-source ticketing and workflow engine built with Gin (Go) and Vue + Element UI. It supports configurable approval flows, te… | 38 | 6620 | active |
| redmine/redmine Redmine is a flexible, self-hosted project management web application written in Ruby on Rails. It provides issue tracking, wikis, forums, … | 77 | 6020 | stable |
| CanCanCommunity/cancancan CanCanCan is an authorization library for Ruby and Ruby on Rails that restricts which resources a user can access. Permissions are defined … | 66 | 5686 | stable |
| openfga/openfga OpenFGA is a high-performance, open-source fine-grained authorization and permission engine inspired by Google's Zanzibar, owned by the CNC… | 99 | 5661 | stable |
| next-terminal/next-terminal Next Terminal is an open-source bastion host (jump server) and interactive session auditing system supporting SSH, RDP, VNC, Telnet, HTTP, … | 99 | 5612 | active |
| doorkeeper-gem/doorkeeper Doorkeeper is a Ruby gem (Rails engine) that adds OAuth 2.0 provider functionality to Ruby on Rails or Grape applications. It implements th… | 94 | 5521 | stable |
| permitio/opal OPAL (Open Policy Administration Layer) is an administration layer for policy engines such as Open Policy Agent (OPA) and Cedar Agent. It d… | 94 | 5505 | active |
| unkeyed/unkey Unkey is an open-source, source-available developer platform for modern APIs that combines instant deployments, a globally distributed gate… | 92 | 5423 | active |
| authlib/authlib Authlib is a Python library for building OAuth 1.0/2.0 and OpenID Connect clients, authorization servers, and protected resource servers, w… | 93 | 5406 | stable |
| ory/keto Ory Keto is an open-source authorization server implementing Google's Zanzibar model for scalable, low-latency permission checks. It suppor… | 80 | 5390 | active |
| kanidm/kanidm Kanidm is a simple, secure, and fast identity management platform written in Rust that acts as a complete identity provider for other appli… | 99 | 5291 | active |
| openiddict/openiddict-core OpenIddict is a flexible OAuth 2.0/OpenID Connect framework for .NET, providing server, client, and token validation stacks. It supports st… | 97 | 5236 | stable |
| pomerium/pomerium Pomerium is an open-source, identity- and context-aware reverse proxy that provides clientless, zero-trust access to internal applications … | 99 | 4978 | active |
| dpgaspar/Flask-AppBuilder Flask-AppBuilder is a rapid application development framework built on top of Flask, providing automatic CRUD generation for SQLAlchemy mod… | 92 | 4958 | stable |
| orchidsoftware/platform Orchid is a free, open-source Laravel package for rapid code-driven development of back-office applications, admin panels, and dashboards. … | 91 | 4793 | active |
| Heeexy/SpringBoot-Shiro-Vue A full-stack reference project demonstrating fine-grained RBAC permission management using Spring Boot on the backend and Vue with ElementU… | 69 | 4656 | active |
| build-trust/ockam Ockam is a Rust library and CLI toolkit for building secure-by-design distributed applications with end-to-end encryption, cryptographic id… | 61 | 4633 | active |
| homarr-labs/homarr Homarr is a self-hosted web dashboard for organizing and monitoring your apps and services, with 40+ integrations, built-in icons, and drag… | 89 | 4614 | active |
| cerbos/cerbos Cerbos is an open-core, language-agnostic policy decision point (PDP) that externalizes authorization from application code using context-a… | 94 | 4555 | stable |
| apache/shiro Apache Shiro is a comprehensive Java security framework providing authentication, authorization, cryptography, and enterprise session manag… | 95 | 4451 | active |
| zoontek/react-native-permissions A React Native library providing a unified permissions API across iOS, Android, and Windows. It lets apps check, request, and manage device… | 95 | 4379 | active |
| open-policy-agent/gatekeeper Gatekeeper is a CNCF policy controller for Kubernetes built on Open Policy Agent (OPA). It enforces admission policies via customizable con… | 97 | 4269 | stable |
| marmotedu/iam IAM is an enterprise-grade identity and access management system written in Go, used to authenticate users and authorize access to resource… | 28 | 4205 | active |
| aarondl/authboss Authboss is a modular authentication system for Go web applications, providing pluggable modules for common auth features like login, regis… | 70 | 4198 | active |
| simov/grant Grant is an OAuth proxy middleware for Node.js supporting 200+ OAuth providers across OAuth 1.0a, OAuth 2.0, and OpenID Connect. It integra… | 34 | 4169 | stable |
| oauthjs/node-oauth2-server A Node.js module for implementing a fully RFC 6749/6750 compliant OAuth2 server/provider, framework-agnostic with official wrappers for Exp… | 23 | 4066 | active |
| hashicorp/boundary HashiCorp Boundary is an identity-aware proxy that provides secure, least-privilege access to hosts and critical systems across clouds and … | 89 | 4056 | active |
| stylefeng/Guns Guns is a modern Java application development framework built on Spring Boot 3, Vue 3, and JDK 17, providing a full-stack admin scaffold wi… | 56 | 3974 | active |
| django-guardian/django-guardian django-guardian is a Python library that implements per-object (row-level) permissions on top of Django's built-in authorization backend. I… | 97 | 3910 | stable |
| panva/node-oidc-provider A Node.js library implementing an OpenID Certified OAuth 2.0 Authorization Server with full OpenID Connect support. It is highly configurab… | 99 | 3800 | active |
| go-oauth2/oauth2 A Go library for building OAuth 2.0 authorization servers that issue and manage access tokens. It supports the standard OAuth 2.0 protocol … | 44 | 3622 | stable |
| ory/oathkeeper Ory Oathkeeper is a cloud native Identity & Access Proxy (IAP) and Access Control Decision API written in Go that authenticates, authorizes… | 80 | 3597 | active |
| JosephSilber/bouncer Bouncer is a PHP library for managing roles and abilities on Eloquent models, with support for ownership checks, forbidden abilities, cachi… | 67 | 3579 | stable |
| maticzav/graphql-shield GraphQL Shield is a TypeScript library that lets you build a permission layer for GraphQL servers using an intuitive rule-based API. It wor… | 67 | 3578 | stable |
| guildxyz/guild.xyz Guild.xyz is an open-source web application for token-curated community membership management, providing token-gated access to Discord, Tel… | 55 | 3487 | active |
| blitz-js/blitz Blitz.js is a fullstack toolkit built on top of Next.js that adds a typesafe RPC data layer, authentication/authorization, and code scaffol… | 60 | 14129 | maintenance |
| metorial/metorial Metorial is an open-source identity and access control plane for AI agents, providing 1200+ verified MCP integrations with centralized auth… | 64 | 3350 | active |
| django-oauth/django-oauth-toolkit Django OAuth Toolkit is an OAuth 2.0 authorization server and resource server library for Django projects, built on OAuthLib and RFC 6749 c… | 95 | 3333 | active |
| workos/authkit AuthKit is WorkOS's authentication UI and User Management platform, offering a fully themeable hosted login box or a headless API for build… | 70 | 3314 | active |
| RolifyCommunity/rolify rolify is a Ruby gem providing simple role management for Rails applications, with support for scoping roles to specific resource objects. … | 52 | 3177 | stable |
| kite-org/kite Kite is a lightweight, modern web-based Kubernetes dashboard that unifies multi-cluster management, resource operations, observability, ent… | 85 | 3096 | active |
| ContainerSSH/ContainerSSH ContainerSSH is an SSH server written in Go that launches on-demand containers in Docker or Kubernetes for each connecting user. It support… | 80 | 3073 | active |
| jeremykenedy/laravel-auth A complete Laravel 12 starter application with email registration verification, social authentication via Socialite, user roles and permiss… | 78 | 3045 | active |
| oauthlib/oauthlib OAuthLib is a Python framework implementing the OAuth 1.0 (RFC 5849) and OAuth 2.0 (RFC 6749) request-signing and authorization logic in a … | 75 | 2980 | stable |
| zenstackhq/zenstack ZenStack is a TypeScript data layer toolkit providing a schema-first, type-safe ORM with a Prisma-compatible API built on Kysely, plus buil… | 95 | 2930 | active |
| apache/casbin-node-casbin Node-Casbin is an open-source authorization library for Node.js and Browser that enforces access control based on configurable models such … | 95 | 2916 | stable |
| bezhanSalleh/filament-shield A Filament plugin that adds role and permission-based access management to Filament admin panels, built on spatie/laravel-permission. It ge… | 96 | 2826 | active |
| DefGuard/defguard Defguard is a self-hosted zero-trust access management platform combining WireGuard VPN with built-in MFA/2FA, identity and access manageme… | 98 | 2809 | active |
| ArgoZhang/BootstrapAdmin BootstrapAdmin is a free, premium-looking admin control panel built on Bootstrap 4.x and .NET (C#). It provides a ready-made management bac… | 58 | 2808 | active |
| PowerDNS-Admin/PowerDNS-Admin PowerDNS-Admin is a self-hosted web interface for managing the PowerDNS Authoritative Server. It provides DNS zone and record management wi… | 98 | 2803 | active |
| rafalp/Misago Misago is a full-featured, modern forum application built with Django, Python, and HTMX, designed to be fast, scalable, and responsive. It … | 91 | 2777 | active |
| MetapriseAI/OrgKernel OrgKernel is an open-source trust layer for AI agents providing cryptographic agent identity (Ed25519), scoped execution tokens, SHA-256 ha… | 55 | 2700 | active |
| yzcheng90/x-springboot X-SpringBoot is a lightweight Java rapid development platform built on Spring Boot 3 and JDK 21 with virtual threads, offering RBAC permiss… | 57 | 2692 | active |
| apache/casbin-jcasbin jCasbin is an Apache-licensed Java authorization library that enforces access control using models such as ACL, RBAC, and ABAC defined in c… | 88 | 2652 | stable |
| ory/fosite Fosite is a security-first, extensible OAuth 2.0 and OpenID Connect SDK for Go, implementing RFC 6749, RFC 6819, PKCE, and OpenID Connect C… | 58 | 2612 | active |
| tbruyelle/RxPermissions An Android library that wraps the Android M runtime permission model in RxJava2 reactive streams. It lets developers request permissions li… | 10 | 10403 | maintenance |
| liukuo362573/YiShaAdmin YiShaAdmin is an open-source admin management system built on .NET Core MVC with a clean Bootstrap/jQuery UI. It provides role-based permis… | 32 | 2580 | active |
| FreeRADIUS/freeradius-server FreeRADIUS is a high-performance, highly configurable multi-protocol policy server supporting RADIUS, DHCPv4/v6, DNS, TACACS+, and VMPS, wr… | 87 | 2574 | stable |
| pac4j/pac4j pac4j is a Java security engine for authenticating users, managing profiles, and enforcing authorizations across web applications and servi… | 77 | 2521 | stable |
| symfony/security-bundle SecurityBundle is the official Symfony bundle that integrates the Security component into the Symfony full-stack framework. It provides con… | 97 | 2489 | stable |
| voidauth/voidauth VoidAuth is an open-source single sign-on (SSO) and user management provider for self-hosted applications, acting as an OIDC provider, prox… | 85 | 2478 | active |
| huanzi-qch/base-admin Base Admin is a simple, general-purpose Java admin management system built on Spring Boot, Spring Security, Spring Data JPA, Thymeleaf, and… | 73 | 2447 | active |
| panva/openid-client openid-client is a TypeScript library providing OAuth 2.0 and OpenID Connect client APIs for JavaScript runtimes including Node.js, Deno, b… | 99 | 2398 | stable |
| onury/accesscontrol A Node.js library implementing Role-Based Access Control (RBAC) merged with Attribute-Based Access Control (ABAC), including role inheritan… | 96 | 2327 | active |
| benedmunds/CodeIgniter-Ion-Auth Ion Auth is a simple and lightweight authentication library for the CodeIgniter 4 PHP framework. It provides user registration, login, grou… | 32 | 2307 | stable |
page 1 / 6 next →