Why Self-Hosted Apps Dey Charge SSO Tax

Wetin SSO tax mean

SSO tax for self-hosted software na pattern wey application dey free, but na single sign-on (SSO) be the one feature wey you must pay for. You fit run the whole software for your own VPS without licence key and without seat limit. Then you open authentication page for the documentation and see OpenID Connect (OIDC) or SAML (security assertion markup language) under paid plan.

This matter pass ordinary feature wey dem lock behind payment, because na SSO dey make group of self-hosted services behave like one system. Identity provider (IdP) give each person one account, one password policy, one place to enable multi-factor authentication (MFA), and one place to disable person account. Without am, every app go keep small user database of its own, and you go manage each one by hand.

This pattern don old reach where public scoreboard dey exist. SSO Wall of Shame for sso.tax list vendors wey dey charge big extra money for single sign-on. The list get entries wey reach 2018, and the author set fair standard: "If your SSO support is a 10% price hike, you're not on this list." Most of the software for that list na closed software. Now, open source projects wey you host by yourself don start to use the same pricing logic.

Why maintainers dey put single sign-on behind paid tier

Two reasons dey, and both honest. SSO dey cost plenty to support, and e dey among the few features wey large organisation go pay for.

The support cost na real matter because identity integration no dey ever truly finish. Every IdP dey format its claims small differently. Group mapping, session lifetime, redirect URLs, and clock skew fit each cause login bugs. Login bug fit lock out every user at once, so those tickets dey urgent. After that, follow-on requests go come: nested groups, role mapping, automatic provisioning with SCIM (system for cross-domain identity management), and audit logs wey compliance team go read.

The revenue side na arithmetic, no be malice. Company wey no fit connect the app to its own IdP no go deploy am at all. So SSO dey draw clear line between user wey go pay and user wey no go pay. Open core project must put that line somewhere. SSO fit sit for that line better than almost any other feature, na why many projects dey choose am.

Make we correct one common complaint: check the changelog before you assume say dem remove feature, because removal go show for release notes. For all the projects wey I check for this post, dem build the paid SSO features for paid tier from the beginning. I no find any case where dem withdraw working free SSO. Grafana na typical example. Its SAML page get one-line note: "Available in Grafana Enterprise and Grafana Cloud", while generic OAuth against your own issuer dey work for the open source build.

Wetin SSO tax really dey cost you

The money na the smaller part. Dem dey sell paid tiers per user, so bill dey grow as your team grow, while hosting and upgrades still remain your responsibility.

The bigger cost na manual identity work, and e dey show for four places.

• One password store for each app, so one reused password become hole for every app wey share am.
• Offboarding from memory. You must remember every service wey person don use, and the one wey you forget na the one wey matter.
• MFA configured one app after another, where the app support am at all.
• Shared logins, na wetin really dey happen for small teams under this pressure.

That last point deserve sentence of e own. When team share one administrator account for document manager, audit trail go record one name for everything, so you no fit know who delete the invoice. Per-user permissions stop to work too, because na only one user dey. Na this be the real damage from SSO tax: e dey push small teams toward one shared account, and that one worse pass any of the alternatives.

Checklist wey you suppose run before you adopt anything

Run this before docker compose up, no be after the app don hold 400 documents.

1. Open authentication page for the docs and read the tier note for top. Paid features dey carry badge or one-line availability sentence.
2. Confirm say the app dey speak OIDC or SAML to your own issuer, instead of one fixed list of public providers.
3. Check role and group mapping. To create the user na half the work, and to assign permissions by hand for ten apps na the half wey dey pain.
4. Check whether the app dey accept authenticated username for header from trusted proxy, and whether you fit specify which proxy e trust.
5. Read licence history for git, and check whether contributors dey sign CLA (contributor licence agreement).
6. Check offboarding. Find out wetin happen to API (application programming interface) tokens and live sessions when dem disable the IdP account.

Item 2 na where most disappointment dey happen. A "Sign in with Google" button no be OIDC with your identity provider: na fixed integration with one vendor. Real support go ask you for issuer URL, and discovery go provide everything else. You fit confirm your provider side with one command.

curl -s https://id.example.com/.well-known/openid-configuration \
  | jq '.issuer, .authorization_endpoint, .token_endpoint'

Three URLs go return from healthy provider. Empty result or 404 normally mean say discovery path wrong, and that path dey provider specific: Keycloak dey publish am under /realms/<realm>/.well-known/openid-configuration. If the app no get field for issuer URL at all, e no fit talk to your IdP, no matter wetin feature list talk.

Item 6 dey catch people weeks after person don leave. Disabling the account for IdP dey stop new logins. E no revoke API token wey the app issue before, because the app dey validate that token by itself and e never ask IdP about am. So offboarding get two steps: disable the account for IdP, then delete the user or its tokens inside each app.

Wetín the tier badges really talk

Dem check all these against each project own documentation for August 2026. Start with the paid side.

Grafana publish SAML as "Available in Grafana Enterprise and Grafana Cloud", together with team sync and SCIM provisioning. Generic OAuth, GitHub OAuth, LDAP (lightweight directory access protocol) and the auth proxy dey available for the open source build, so small self-hoster still fit log in through their own provider. The paid line dey start for SAML, not for single sign-on as a whole. Na this detail the phrase "SSO tax" dey flatten.

Metabase talk am more directly. Their documentation say, "SAML authentication is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud)." The open source edition still get password login and LDAP.

Passbolt mark their SSO documentation as Pro and Cloud, so the community edition no get am. The documented providers include Keycloak and Entra ID.

Now make we look the other side, because this pattern no apply everywhere.

• GitLab Self-Managed get "Tier: Free, Premium, Ultimate" for its SAML page, so SAML against your own GitLab no cost anything.
• Paperless-ngx configure OIDC through django-allauth with PAPERLESS_SOCIALACCOUNT_PROVIDERS, hide the local login form with PAPERLESS_DISABLE_REGULAR_LOGIN, and map claims to groups with PAPERLESS_SOCIAL_ACCOUNT_SYNC_GROUPS.
• Planka take OIDC_ISSUER, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET, set its scopes to openid profile email by default, and promote administrators from a role claim with OIDC_ADMIN_ROLES.
• BookStack switch over with AUTH_METHOD=oidc, then map provider groups to its own roles with OIDC_USER_TO_GROUPS=true and OIDC_GROUPS_CLAIM.
• Vaultwarden release "support for SSO with OpenID Connect" for 1.35.0 on 27 December 2025, from a pull request by one contributor wey don carry the feature for a fork.
• listmonk don get OIDC login together with its user roles since v4.0.0.

Use this information when you dey choose, not after you don commit. One Planka kanban board and the other self-hosted Trello alternatives no dey handle identity the same way, and BookStack, Wiki.js and Outline no dey handle am the same way too. Free OIDC na feature wey you fit weigh like storage limits or mobile clients. If you never finish to draw the list, wetin to self-host for 2026 na reasonable starting point, and both the Paperless-ngx document manager and Vaultwarden give you free OIDC today.

Why reverse proxy wey dey in front of app no be single sign-on

The common workaround na forward auth. Your reverse proxy go hold each request, ask authentication service whether this browser don sign in, and na only then e go pass the request go app. authentik dey call this proxy provider, with forward auth mode for one application and another one for whole domain. Authelia and oauth2-proxy dey do the same work.

Caddy site block fit look like this, following authentik own example.

app.example.com {
  forward_auth http://authentik-outpost:9000 {
    uri /outpost.goauthentik.io/auth/caddy
    copy_headers X-Authentik-Username X-Authentik-Email X-Authentik-Groups
    trusted_proxies private_ranges
  }
  reverse_proxy app:8000
}

Capitalisation of those header names matter for Caddy, because if the name no match, e go arrive empty. For every request wey e approve, the outpost dey set X-authentik-username, X-authentik-email, X-authentik-groups and some other ones.

This na wetin e give you. Nobody fit reach the app without first passing through your identity provider, so unpatched login form no longer dey exposed to internet, and MFA dey apply to everything behind the proxy at once.

This na wetin e no give you: identity inside the app. The app still get its own accounts and its own idea of who don sign in. If everybody pass the proxy and land for one shared administrator account, you get strong front door but one anonymous session behind am. Audit log still dey show one name. Permissions still no fit differ between people. To call this arrangement SSO na security mistake, because the offboarding story only true halfway: removing the person from your IdP go close the front door, but API token wey dem create inside the app go still work for anybody wey fit reach the app directly.

Header authentication make safe

Some apps dey accept username from proxy, wey give you identity for each user without paid SSO. Each project get different name for this setting.

Grafana dey call am auth proxy, and e ship with am disabled. The default header name na X-WEBAUTH-USER, and you fit point am to any header wey your proxy dey set.

[auth.proxy]
enabled = true
header_name = X-authentik-username
header_property = username
auto_sign_up = true
whitelist = 10.0.0.5

whitelist na the line wey people dey skip. Grafana documentation talk clearly say e dey prevent users from spoofing the header. So e suppose contain only the address of your proxy. Gitea get the same feature under different names, and e ship with safer default.

[security]
ENABLE_REVERSE_PROXY_AUTHENTICATION = true
REVERSE_PROXY_AUTHENTICATION_USER = X-WEBAUTH-USER
REVERSE_PROXY_TRUSTED_PROXIES = 10.0.0.5/32
REVERSE_PROXY_LIMIT = 1

REVERSE_PROXY_TRUSTED_PROXIES default na 127.0.0.0/8,::1/128, and REVERSE_PROXY_LIMIT na the number of proxies wey Gitea go trust for the chain. If you set the limit to zero, e go turn off header handling completely.

Paperless-ngx offers PAPERLESS_ENABLE_HTTP_REMOTE_USER with PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME, and the documentation give this warning wey apply to all these settings:

This one go allow authentication just by adding Remote-User: <username> header to request. Use am carefully!

Two rules dey keep header authentication safe, and both concern reachability. First, app must no dey reachable except through the proxy. Anybody wey fit open socket to am fit send that header and become any user. For Docker, ports: ["8000:8000"] dey publish for every interface. So bind am to loopback address with ports: ["127.0.0.1:8000:8000"], or remove the published port and put the proxy for the same Docker network. Second, proxy must delete any copy of the header wey client send. This make sure say the only value app ever sees na the one your proxy sets after authentication.

Check both. Run the first command from machine wey dey outside your VPS, and run the second one for the server itself.

curl -si -H "Remote-User: admin" http://203.0.113.10:8000/ | head -n 1
ss -ltnp | grep 8000

The curl suppose fail to connect, and ss suppose print 127.0.0.1:8000 instead of 0.0.0.0:8000. If the first line show HTTP/1.1 302 Found, e mean say app dey answer the public internet directly. Anybody fit sign in as any user by putting their name for a header.

When free SSO no dey, make decision instead of complaining

These na four options, arranged for the order wey I go try dem.

1. Choose the app wey include OIDC. If two projects dey do the same work and one fit connect to your identity provider for free, that one na real difference for running cost.
2. Use forward auth honestly. For admin tool wey get one account and one operator, proxy for front dey enough. Per-user identity inside the app no dey add anything.
3. Pay. If the app dey central to your work and per-seat price fit your team size, the money go help maintain the project. The alternative na to pay with your evenings.
4. Ask upstream, after you search the issue tracker. Vaultwarden OIDC support come through contributor's fork and long-running pull request. So feature request wey get working implementation behind am fit sometimes enter the free edition.

None of this go work without your own identity provider. Na this one you suppose build first. Run authentik for VPS go give you OIDC and SAML provider, plus the forward auth outpost wey we use above. Comparison of Keycloak, authentik and Zitadel explain the trade-offs if you prefer make you no commit yet.

Licence history, and why e dey for checklist

The last checklist item dey about future, because today’s tier layout na only one snapshot. Two cases wey dem document well show how fast things fit change, for both directions. HashiCorp adopt Business Source License 1.1 for all future releases on 10 August 2023, while earlier releases remain under MPL 2.0 (Mozilla Public License). Redis move to SSPL (server side public license) for March 2024, then announce on 1 May 2025 say Redis 8 also dey ship under AGPLv3 (GNU Affero General Public License).

Read both as evidence about how the mechanism work, rather than the motive behind am. The licence wey you read today apply to the version wey you install today, and project wey hold all im copyright fit change the terms for the next release by itself. Na why the CLA question dey for checklist, because broad copyright assignment na wetin make unilateral relicence possible.

Check project history by yourself before you build on top of am.

git clone --filter=blob:none https://github.com/paperless-ngx/paperless-ngx.git
cd paperless-ngx
git log --follow --oneline -- LICENSE

Short list of commits, mostly from the first import, na good sign. If dem rewrite the licence file several times, read each commit message before you plan around the current terms.

FAQ

Wetin be SSO tax?

SSO tax na when software company dey charge extra for single sign-on as premium feature, while the rest of the product free or cheap. For self-hosted software, e fit be open source application wey you fit run without licence key, but OIDC or SAML login dey only for paid tier. The name come from SSO Wall of Shame for sso.tax, wey dey track vendors wey dey charge plenty extra for am. For person wey dey self-host, the result be say every app keep im own user database, so you go create and remove accounts by hand.

Forward auth for reverse proxy na the same thing as SSO?

No. Forward auth dey protect the front door: your proxy go check with identity provider before any request reach the app. The app behind am still dey use im own accounts, so if everybody enter through one shared login, you get one anonymous session and audit log wey get only one name. E become real per-user identity only when the app read username from header. Grafana's auth proxy, Gitea's reverse proxy authentication, and Paperless-ngx's PAPERLESS_ENABLE_HTTP_REMOTE_USER fit do this. These settings safe only as long as clients no fit reach the app except through the proxy, because the header na plain string wey any client fit send.

Which self-hosted apps get OIDC for the free edition?

We check am against project documentation for August 2026: Paperless-ngx, Planka, BookStack, Gitea, listmonk and Vaultwarden all support OIDC for their free builds, and GitLab Self-Managed list SAML under Tier: Free. Grafana's open source build fit handle generic OAuth against your own issuer, while SAML for there na Enterprise feature. Confirm am for the project's own authentication page before you install, because these lists dey change with releases.

I suppose pay for the tier wey unlock single sign-on?

Use two numbers decide am: how many people need accounts, and how many apps you for otherwise maintain by hand. For one or two administrators, forward auth in front of local account dey enough, and the paid tier no add much. For team wey people dey join and leave, one account wey you forget during offboarding fit cost pass the licence, and the payment dey fund the maintenance wey you rely on. If the price no fit your budget, the practical choice na to select app wey include OIDC instead of trying to work around one wey no include am.