I've been looking for a good solution to the "I have 3 small web apps that are used by the same people, I should centralise authentication and authorization" problem, and yet to find something sensible for that usecase.
Gluu is just a facade company that's recompiling it from source and distributing the binaries for free.
It supports pretty much everything you can dream of, including different password hashing and you can write your own plugins to interface with anything you like.
However it's a very complicated product. It's for a large company or a country with a dedicated team to run and customize.
P.S. Not affiliated to any of these companies. I had to do the performance assessment of these products some year ago for a government contract. https://thehftguy.com/2015/10/14/iam-benchmarks-openam-vs-ws...
OpenAM is also no longer opensource. The source was closed by Forgerock in the beginning of 2018.
One of the forks that sprung from this source closing is wren:security ( https://wrensecurity.org ). Disclosure: I work on that project ;-)
For this use case, they'd also need to configure JAAS.
I've been thinking of writing my own SAML IdP in Python (since I have plenty of experience with the language) and I'm not naive to the various security things that can go wrong, but I'm no expert cryptographer either.
https://github.com/IdentityPython
That said, I can't think of anyone using pysaml2 to implement identity providers aside from SATOSA, an IdP proxy. Nearly everyone I know runs either Shibboleth or SimpleSAMLphp. I recommend you run Shibboleth because there's a whole litany of interoperability issues you _won't_ encounter if you do. (The same goes for SimpleSAMLphp, but I have less experience with it.)
The IdentityPython and Shibboleth projects have a lot of overlap in terms of membership, and if you want to meet them and connect to the research and education side of the federated IdM community, which drives a lot of the open source work, you should come to the Internet2 Technology Exchange this year and stay for ACAMP. It's a super smart bunch of people. You'll learn a lot.
If you're doing that for a small company, maybe try to get a Microsoft active directory instead. It's a lot easier to setup and maintain and everything does their best to integrate with it.
You don't have to be, as you would not implement any cryptographic algorithms (ciphers, hash methods) yourself. Solid experience with software security in general is a requirement of course.
I tried Gluu and it's a RAM hog for what it does (IMO). I took a look at the developer docs and it seems all but impossible to override the password hashing method with your own (query passwords from your own database instead of LDAP hashed) was one use case I was looking into)
Even storing my custom hashes in LDAP would have been acceptable.