If you want to self-host, Keycloak. You can then either find OIDC/SAML integrations for your systems or use something like Pomerium to add authentication via a proxy.

Just remember that properly upgrading Keycloak without downtime is nearly impossible without booting up a second instance on a clone of your database and moving traffic over there, so if you have anything that needs to work 24/7, wait for HA upgrades feature that's supposedly coming soon.

I'm sure many will disagree, but just implement it yourself if you're an SP.

If you're using a common web framework, there's almost certainly packages/plugins that will manage SSO and 2fa, and despite the constant fud, dealing with user accounts really isn't all that hard. More importantly, understanding the mechanics of your user account system will pay dividends as your product grows and new authN/Z requirements arise.

Apologies that my question wasn't clear enough. I am building a remote company and we use a ton of products. I'd like centralized authentication + sso + ability to enforce yubikeys for AWS, Jira Cloud, Bitbucket, and a ton of others that OKTA supports for SSO.

Azure Active Directory manages this well. If your company uses office365, it's likely you already are using this under the hood.

(Disclaimer: I’m an Okta employee)

Okta works really well in your use case. I recommend trying it out yourself.

Since you mention YubiKeys, I’d also suggest that you try removing passwords from your setup entirely by using YubiKeys and one or more other factors.

If you don’t want to use Okta, I’m also happy to give you my take on the alternatives to consider. Feel free to reach out to me directly.

There are many alternatives like CyberArk, OneLogin, Ping Identity and others.

Are you talking about customer facing SSO?

I'm talking about my company uses jira, git, aws, etc., and I'd like to centrally enforce SSO + yubikeys.

This is just my personal opinion and after evaluating it from a compatibility angle I found that Azure AD is suitable. We are using it with Nextcloud, Apple Business Manager, Tailscale and Figma. U2F is not well supported, but OTP works well (with yubico auth as well of course.

WorkOS