Self-hosted password managers and identity providers (IdPs) both keep team credentials under your control, but they solve different problems. A password manager stores and shares secrets such as logins, notes and API keys between people. An identity provider handles who a user is and grants access to many applications through single sign-on (SSO). Most teams need to understand both, and the right choice depends on whether the main pain is shared credentials or sign-in sprawl across apps.

What a self-hosted password manager does

A password manager is a vault. Users keep their own credentials in it, and teams can share selected items with colleagues. The main benefits are:

  • Unique, generated passwords for each service.
  • Controlled sharing of logins between team members, without pasting secrets into chat.
  • A single encrypted store that you run on your own infrastructure.

Vaultwarden is an unofficial, Bitwarden-compatible password manager server written in Rust. It is aimed at self-hosted deployments with lower resource use, and it works with Bitwarden client applications. It is licensed under AGPL-3.0 and is maintained by the publisher dani-garcia. Because it is unofficial, check that it fits your compliance requirements before adopting it for sensitive data.

What an identity provider does

An identity provider authenticates users once and tells other applications who they are. This is single sign-on: users log in to the IdP and are then signed in to connected tools without separate passwords. An IdP typically supports standards such as OAuth2, OpenID Connect (OIDC) and SAML, and it can centralize user accounts, groups and access decisions.

Keycloak is an open-source identity and access management library and server for adding SSO, OIDC, SAML and authorization to applications and services. It is licensed under Apache-2.0 and maintained by the keycloak publisher.

authentik is an open-source identity provider for single sign-on. It supports SAML, OAuth2/OIDC, LDAP and RADIUS, and it is aimed at self-hosted setups from small labs to large clusters. Its publisher is goauthentik.

How they differ

The key differences come down to scope:

  • Purpose. A password manager stores secrets. An IdP proves identity and issues access.
  • Who uses it. Password managers are used by individuals and their shared vaults. IdPs sit between your users and every application that supports SSO.
  • Protocols. Password managers expose their own sync and vault APIs. IdPs implement SSO protocols such as OIDC and SAML.
  • Coverage. A vault covers credentials that have no SSO option. An IdP covers applications that can delegate login.

In practice they complement each other. An IdP reduces the number of passwords people must remember, and a vault covers the remaining shared logins and secrets that cannot use SSO.

How to choose

Start from the problem you need to solve.

Choose a password manager when

  • Your team shares many logins to tools that do not support SSO.
  • You need a secure place for shared credentials, notes and similar items.
  • You want a lightweight server with modest resource needs.

Choose an identity provider when

  • Many internal and third-party applications need a single login.
  • You need centralized user, group and access management.
  • You must support standards such as SAML or OIDC, or directory protocols such as LDAP.

Consider both when

  • You have a mix of SSO-capable apps and legacy logins that need safe sharing.

Getting started

  1. List the applications your team uses and mark which support SSO.
  2. Decide where user identities should live and which protocols you need.
  3. Deploy the IdP first if SSO coverage is your main gap, then add a vault for remaining shared secrets.
  4. Test backup and recovery before you rely on either system.
  5. Review the license and maintenance status of each project, since licenses differ (for example AGPL-3.0 for Vaultwarden and Apache-2.0 for Keycloak).

Securing the surrounding code and infrastructure

Identity and secret systems are only as safe as the code and configuration around them. Static analysis tools such as Semgrep, which finds bugs and security vulnerabilities across 30+ languages, help catch issues in your own integrations. Trivy scans container images, filesystems, Git repositories and Kubernetes for vulnerabilities, misconfigurations and secrets, which matters when you deploy these services in containers. To practice finding such flaws safely, OWASP Juice Shop is an intentionally insecure web application for security training.

For scripts that set up or maintain your deployment, ShellCheck is a static analysis tool for shell scripts. More background on related tooling is available in the Security Tools category and the Developer tools catalog page.

Recommendation

For most teams, start with an identity provider to centralize sign-in for applications that support SSO, since this removes the most password reuse and account sprawl. Keycloak suits teams that want a mature, broadly adopted OIDC and SAML server, while authentik suits teams that want a self-hosted IdP that scales from small labs to large clusters and also supports LDAP and RADIUS. Add a self-hosted password manager such as Vaultwarden for shared secrets that cannot use SSO. Pick the combination that matches your applications, and verify backups and compliance requirements before going to production. Browse all options on the Open-source publishers page or the Security Tools category.