Okta

Okta Cross App Access is a protocol for secure agent-to-app and app-to-app access. It enables independent software vendors to use an organization's existing identity provider and single sign-on systems to establish agent identity and obtain authorization grants, allowing agents, sandboxes, and gateways to access applications without embedding credentials in the sandbox.

Microsoft Entra is an identity provider whose groups can be synchronized into a Tailscale tailnet, allowing a gateway to use a user's group membership for identity and access decisions.

WorkOS is an identity and authentication platform for adding enterprise access features to applications. It supports Single Sign-On through SAML and OIDC identity providers, social authentication, passwordless email codes, multi-factor authentication, and user and organization management with configurable policies. The videos also describe it as supporting agent authentication on behalf of users. Its APIs normalize enterprise integrations behind a single interface, with dashboard management, webhook events for directory-service updates, and SDKs for Node.js, Ruby, Python, .NET, Go, PHP, and Java. WorkOS provides AuthKit, an authentication UI built with WorkOS and Radix, and the site states that the platform supports more than 20 enterprise services through one integration point.

Octop is an open-source, self-hosted AI assistant platform for households and small teams. It runs as a single process, storing conversations, workspaces, credentials, and shared state in a SQLite database under ~/.octop/, while serving a web dashboard, CLI, chat integrations, and cron automation. Users can switch among specialized personal agents through its multi-agent architecture. Built on the Harness stack, Octop combines an agent runtime for model routing, tools, skills, and conversation checkpoints with a gateway that normalizes messages from supported chat platforms into one processing pipeline. It also provides a built-in expert library, portable workspace memory, OAuth and MCP connectors, ACP integration for IDE and terminal workflows, browser automation, terminal-assisted command execution, and remote desktop access. The project uses FastAPI and uvicorn, React with TypeScript and Vite, SQLite through aiosqlite, and APScheduler. Its security features include JWT-based multi-user isolation, tool approval, shell-command guardrails, and PII redaction; supported storage backends include local disk, Docker containers, PostgreSQL, and COS/S3.

Dex is an open-source federated OpenID Connect provider developed under the Cloud Native Computing Foundation. It sits between applications and identity sources such as LDAP, SAML, GitHub, Google, GitLab, Microsoft, and other OIDC providers, exposing those sources through a standard OIDC interface so applications do not need separate authentication integrations. Dex is distributed as a single Go binary, container, or Kubernetes deployment, with configuration, clients, storage, and connectors defined in YAML; it includes a login UI and supports Kubernetes single sign-on and local development through a mock connector. In the cited NetBird setup, Dex handles local-user authentication in the background.