Implementing all the main authentication mechanisms is hell.

Oauth2 is utter utter shite as well.

OAuth2 is fine, I mean:

1. It's not an authentication protocol, but it was abused as one for until OpenID Connect came along

2. OpenID Connect is the compatible authN protocol, and it actually has a spec unlike OAuth2

Both of those are annoying because they are over-complicated for simple use cases and for a long time there were very few simple open-source providers that weren't hiding all the important stuff behind their enterprise/cloud versions.

Open source options like Zitadel are improving this space somewhat, though they are still sort of painfully complicated if you want to deploy something small and simple that you can understand. In order to be big business they have to support tons of 3rd-party provider plugins with all their out-of-spec wrinkles.

It would be nice to have something like Zitadel that is signficantly less concerned about all those third parties - like let me very easily just host username/password and passkey auth in a small package.

OAuth2 is about a billion times better than SAML. At least you have a decent chance of doing it securely if you follow the spec vs about zero chance with saml.

Why are you using an authorization protocol for authentication? Try OIDC.