Ah, someone else here has probably encountered CIAM pain too. ;@]

For internal use, FreeIPA is neat (389ds + dogtag). Some people use AD or Azure AD (which again, is outsourcing). Shibboleth provides a FOSS SSO solution. https://www.shibboleth.net/products/

For k8s IdP, there are numerous FOSS, on-prem solutions like pinniped.