Top 30 Open-Source IAM Frameworks for Customizable Access Policies

Red Hat‑backed IAM platform with SSO, LDAP/AD federation, and a powerful Authorization Services engine for policy‑based access control.

Enterprise‑grade provisioning and access management solution supporting RBAC, ABAC, and dynamic policy evaluation.

Feature‑rich IAM server offering OAuth2, OpenID Connect, SCIM, and a flexible policy engine based on XACML.

Open‑source IAM suite with SSO, multi‑factor authentication, and fine‑grained access policies via UMA and XACML.

Modern IAM framework built on Python/Django, providing customizable policy hooks and seamless integration with SAML/OIDC.

Identity and user management system focused on self‑service flows, with extensible policy hooks via webhooks.

OAuth2 & OpenID Connect server that can be paired with any policy engine; supports policy‑as‑code via external decision services.

Perl‑based SSO solution offering LDAP, SAML, and OpenID Connect with a flexible policy language for access control.

Mature Central Authentication Service server with support for attribute release policies, MFA, and fine‑grained authorization extensions.

Open-source version of ForgeRock's IAM platform, delivering policy‑driven access control, federation, and adaptive risk authentication.

Identity governance and provisioning platform with a robust policy engine for role, entitlement, and workflow automation.

Cloud‑native IAM built on Go, offering policy‑as‑code via YAML/JSON, OAuth2, OIDC, and fine‑grained permission models.

Lightweight OIDC identity provider that can proxy to LDAP, GitHub, etc., with customizable scopes and policy enforcement via external adapters.

Self‑hosted authentication and authorization server for web services, supporting 2FA, LDAP, and policy‑driven access rules.

Java‑based SAML identity provider with extensive attribute release policies and support for ABAC via custom plugins.

Open-source identity management engine focusing on provisioning, reconciliation, and policy‑based entitlement management.

Kubernetes‑native IAM platform delivering SSO, RBAC, and policy‑driven access to cluster resources.

Minimalist Go library for building custom IAM services with pluggable policy evaluation (RBAC/ABAC).

Authorization library supporting ACL, RBAC, ABAC, and RESTful policy enforcement across languages (Go, Java, Node, etc.).

General‑purpose policy engine that can be embedded in IAM stacks for fine‑grained, declarative access decisions.

Proxy that enforces Keycloak policies on any HTTP service; still useful for legacy deployments.

JBoss security framework offering identity management, SSO, and flexible policy enforcement (now superseded by Keycloak).

Open‑source .NET Core implementation of OpenID Connect and OAuth2 with extensible policy services (community‑maintained).

Policy decision point from Ory, implementing a flexible ACL/ABAC model via JSON‑based policies.

Yahoo’s open‑source platform for service authentication and fine‑grained authorization using role‑based policies.

Built‑in XACML‑style policy engine within Keycloak for resource‑based permissions and dynamic policy evaluation.

Kubernetes admission controller that enforces OPA policies, ideal for cluster‑wide IAM policy enforcement.

Community edition of ForgeRock AM delivering policy‑centric access control, MFA, and federation.

Modular IAM framework with policy‑as‑code, consent management, and support for OAuth2/OIDC.

Graph‑based IAM engine that stores identities and policies as a knowledge graph for expressive ABAC queries.

While the platform is commercial, its SDKs are open source and enable custom policy extensions.

Collection of community‑maintained OPA plugins tailored for IAM use‑cases such as RBAC, ABAC, and entitlement checks.

Community extensions that add custom policy evaluation hooks to Keycloak, enabling policy‑as‑code workflows.

SDKs (Node, .NET, Java, etc.) that let you embed Auth0’s policy engine into custom applications; the SDKs themselves are open source.