I was thinking Kanidm [1] for authentication and SpciceDB [2] for authorization would be a good combo, but I haven't gotten around to trying it yet.

[1]: https://kanidm.com/

[2]: https://authzed.com/docs/spicedb/getting-started/discovering...