authentik

Keycloak is an open-source identity and access management system for applications and services. It provides user federation, strong authentication, user management, fine-grained authorization, and support for identity protocols including OpenID Connect and SAML; in the described agent-security context, agents can be registered as OAuth2 clients. The project can be run from its distribution or Docker image and is licensed under the Apache License 2.0.

An open-source authentication library for JavaScript and TypeScript web applications maintained by the Auth.js project. It implements OAuth/OpenID Connect provider sign-in, email and credential-based authentication, session management (JWT or database-backed sessions), and provides adapters to persist accounts and sessions. Auth.js runs on Node.js and is commonly used with Next.js and other Node web frameworks; source code is published on GitHub and the project is distributed under the MIT license.

Better Auth is an authentication library used to add sign-in and protect an application's administrative interface.

Pocket ID is a self-hosted OpenID Connect and OAuth 2.0 identity provider that authenticates users with passkeys instead of passwords. It provides group-based access control, LDAP integration, SCIM provisioning, audit logs, a REST API for administration, and resource-specific OAuth tokens with configurable scopes. Applications and APIs can use Pocket ID for passwordless sign-in, while compatible AI applications and remote MCP servers can use it as an OAuth provider.

Dex is an open-source federated OpenID Connect provider developed under the Cloud Native Computing Foundation. It sits between applications and identity sources such as LDAP, SAML, GitHub, Google, GitLab, Microsoft, and other OIDC providers, exposing those sources through a standard OIDC interface so applications do not need separate authentication integrations. Dex is distributed as a single Go binary, container, or Kubernetes deployment, with configuration, clients, storage, and connectors defined in YAML; it includes a login UI and supports Kubernetes single sign-on and local development through a mock connector. In the cited NetBird setup, Dex handles local-user authentication in the background.