Only commenting on the SSO part, but try Kanidm, it’s really well done and the community is lovely.