Keycloak supports 2FA/MFA, Active Directory, LDAP. You might need a plugin for SCIM, but it does a whole load of other wonderful things, and it doesn't cost $2

Keycloak supports 2FA/MFA, Active Directory, LDAP. You might need a plugin for SCIM, but it does a whole load of other wonderful things, and it doesn't cost $2 per user per month. You will have to find someone to host and patch it, but we shouldn't pretend it's up there with write your own crypto. Using saas is fine too. Often there cheaper than hiring a person until you need said person anyway, and at that point they're just a single point of failure, and people do underestimate the effort to run a production service well. But we shouldn't be so anti-intellectual that we pretend that it's the only way to do things, and that well supported foss products don't exist.