If you want to self-host, Keycloak. You can then either find OIDC/SAML integrations for your systems or use something like Pomerium to add authentication via a proxy.

Just remember that properly upgrading Keycloak without downtime is nearly impossible without booting up a second instance on a clone of your database and moving traffic over there, so if you have anything that needs to work 24/7, wait for HA upgrades feature that's supposedly coming soon.