Rodauth is a Ruby authentication framework designed as a Roda plugin, but also usable as middleware or a standalone library. It provides a comprehensive, modular authentication system covering login, logout, account creation, password management, multi-factor authentication (TOTP, WebAuthn, SMS, recovery codes), JWT/JSON API support, session management, and many security features like lockout, password complexity, and audit logging. The architecture is built around a declarative feature DSL where each feature is a self-contained module that can be enabled via `plugin :rodauth` and configured with hundreds of overridable methods. The core library defines a `Rodauth::Auth` class instantiated per request, with metaprogramming for hooks, routes, and value methods. The codebase is exceptionally well-crafted, with a clean separation of concerns, extensive use of inheritance and composition, and a strong emphasis on security (HMAC tokens, timing-safe comparisons, database functions for password hashing). It is actively maintained by the author Jeremy Evans with a long history of releases and security fixes.
Authelia is a self-hosted, open-source authentication and authorization server providing single sign-on (SSO), multi-factor authentication (MFA), and access control for reverse proxies. The backend is written in Go, using fasthttp for HTTP, koanf for configuration, and supports multiple storage backends (SQLite, PostgreSQL, MySQL) and authentication backends (LDAP, file-based, PAM). It implements a full OpenID Connect 1.0 / OAuth 2.0 provider with certified conformance, WebAuthn (FIDO2) passkeys, TOTP, Duo Push, and passwordless authentication. The frontend is a React/TypeScript single-page application with i18n, custom UI components, and integration with the backend via REST APIs. The architecture follows a service-oriented pattern with middleware chains, configuration validation, and extensive unit and integration tests. The codebase is well-structured, modular, and demonstrates high craftsmanship in areas like timing attack mitigation, clock abstraction for testability, and configuration validation.