1. Use an Identity Provider (IDP)*. Other people have mentioned LDAP, which can play this role.

2. Use groups within the IDP to declare who has what privileges.

3. Apps using the IDP for auth can read the groups and allow/deny permissions based on groups.

*Or Identity and Access Management if you are in the cloud ig.

For open source solutions, I would recommend:

• Authentik (what I use)
• Kanidm (doesn’t have web ui)
• Nubus by Univention

These three solutions all have invites, ldap, and can act as oauth providers. (Oauth is single sign on), which are the features I want. There are also integrated, including it all in the one app.

There is also LLDAP, which is a web ui for ldap, and then you could use a service that connects to that, like authelia or keycloak, to add oauth on top.