Guide
Which project management tools include SSO for free?
Short answer
Among self-hosted tools, Vikunja and WeKan include OIDC single sign-on in their free builds, and Redmine and Kanboard can do it through plugins. Maki deliberately uses email/password authentication, while OpenProject, Plane, and PLANKA reserve SSO for a paid edition or tier. Among hosted SaaS tools, SSO is almost always an Enterprise-tier feature.
Last updated 19 August 2026. Written by the Maki team, who also build one of the tools mentioned.
Why single sign-on ends up behind a paywall
Because it is the feature that identifies a buyer. A team asking for SAML or OIDC has an identity provider, which means an IT function, which means a budget. Pricing pages have quietly used SSO as a proxy for company size for a decade, and the industry has a name for the result.
The security argument against this is straightforward. Single sign-on is how an organisation offboards someone in one place, enforces multi-factor authentication, and stops password reuse. Charging a premium for it means the smallest and least-resourced teams get the least secure defaults.
It matters more in self-hosted software, because the promise there is that running it yourself is the free path. If authentication is the part that is not free, the promise is thinner than it looks.
Self-hosted tools: where SSO sits
Vikunja
FreeOIDC is supported in the free build. Note that other features, including time tracking and audit logs, belong to the paid Vikunja Pro add-on for self-hosters.
WeKan
FreeOAuth2 and OIDC providers are supported on the MIT-licensed build.
Redmine and Kanboard
PluginBoth can authenticate against an identity provider through community plugins, with the usual caveat that plugins are pinned to versions and maintained by volunteers.
OpenProject
Enterprise add-onSAML, OIDC, Kerberos, and Okta support belong to the Enterprise add-on rather than the GPLv3 Community edition.
Plane
Paid tiersSSO with SAML and OIDC starts at the Pro tier, with LDAP and group sync on Enterprise Grid.
PLANKA
Pro tier since 2.2OIDC moved into the paid Pro tier in version 2.2. Self-hosters who had been signing in with OIDC found those accounts deactivated after upgrading.
Hosted tools: what SSO costs
Asana places SAML on Enterprise, which is quote-only. Shortcut places SSO on Enterprise. monday.com places it on Enterprise. Jira Cloud requires Atlassian Guard, a separate per-user subscription, unless you are on Enterprise, which includes it. Notion includes SAML from Business at $20 per member a month. ClickUp includes Google SSO from Business and custom SAML at the Enterprise level. GitHub includes SAML from Enterprise at $21 per user a month.
The pattern is consistent enough to plan around: if your company adopts an identity provider, assume every hosted tool in your stack will move up at least one tier.
Frequently asked
What is the SSO tax?
The term for the large price jump between a vendor's standard plan and the plan that includes single sign-on. It is common enough that a public list, sso.tax, has tracked it for years. The criticism is that it prices a basic security control as a luxury.
Which self-hosted project management tool has free SSO?
Vikunja and WeKan include OIDC on their free builds. Redmine and Kanboard can add it through community plugins.
Does Maki support OIDC single sign-on?
No. Maki deliberately uses email and password for interactive sign-in. Its OAuth support is limited to authorizing MCP and device clients, not signing users into the web app.
Does SSO require an enterprise identity provider?
No. Signing in with a Google or GitHub account is single sign-on for most small teams, and both are free. A dedicated provider such as Keycloak or Authentik is worth it once you want central offboarding and group mapping.