keycloak is pretty nice for that. You can just drop some docker-compose somewhere (or k8s) or plain wildfly/tomcat and you have saml idp + oauth2 (openid connect) out of the box including ui and self-service for users - it's also completly themeable (that's what I'm doing at the moment for a project)...

you don't even need a ldap/ad in the background but you can connect to one.

however it's strictly for authentication and authorization - basically users + roles

vault is different usecase but can probably be connected.