I did find these two:

https://github.com/mustafaturan/authable

Anyone use these and recommend one over the other?

A follow up to this thread. I ended up going with danschultzer/ex_oauth2_provider and it’s worked great.

I do not have affiliation with any of them, I just use them time to time in my demos, that was the first ones that come to my mind…

I would also go with self hosted and open source ones, but the Auth0 free tier seems to be very generous, if is only for a pet project.

Another option, used a lot in the enterprise world, and this time open source:

Add authentication to applications and secure services with minimum fuss. No need to deal with storing users or authenticating users. It’s all available out of the box.

You’ll even get advanced features such as User Federation, Identity Brokering and Social Login.

For more details go to about and documentation, and don’t forget to try Keycloak. It’s easy by design!

That’s true only if your applications do share the same hostname, as we are talking of cookie-based sessions and cookies won’t be sent to different hostnames.

OAuth is more for API access control (think mobile applications, SPAs and access delegation to third party apps), while OpenID Connect (an OAuth2 superset) is for delegated authentication (think SSO between web apps). It’s kind of the successor to SAML2. It may be what you’re looking for. I’d add CAS server (java) and Identity Server (.NET) to the list of open-source server supporting OAuth2, OpenID Connect and SAML2.

However as long as you can stick with using a web cookie-based session you might be better with that because these federation protocols add a whole new complexity to your stack.