FusionAuth

* The installation and maintenance process is straightforward, especially that they've provided a Helm chart that can be deployed directly to a Kubernetes cluster. When I first installed it, v1.15.8 required Elasticsearch. But in v1.16.0 and newer, Elasticsearch is optional so it's much easier to get started especially for those with less than 10,000 users.
* The functionality is complete. It's amazing how FusionAuth can bundle so many functionality in one software bundle AND also make it relatively easy to install. General SSO, OpenID Connect, SAML, 2FA: all the basics are covered, and more.
* Multi-tenant. This is unique with FusionAuth: with a single FusionAuth instance you can service SSO multiple groups or even multiple companies. This can dramatically reduce cost if you're need to share resources. Or perhaps you need separate tenants for staging and development environments, you're not required to buy a separate license for this.
* Free license available
* Support is good even without an enterprise contact (FusionAuth Forum & GitHub)

* MariaDB isn't yet officially supported. It's a minor quibble and is probably irrelevant to most people, but I do wish FusionAuth would have supported this. It's actually possible to run FusionAuth with MariaDB, just that you'll need to be prepared to potential (current and future) issues, that you don't have to worry if you use PostgreSQL or MySQL.
* Not open source. Again this is a minor quibble. I'd prefer if FusionAuth open sources or even made "source-available" the core parts of FusionAuth. It'd make problems much easier to debug especially if there are users willing to help debugging. For businesses getting a support contract directly from FusionAuth it's probably not an issue.

While evaluating different auth systems, we found ourselves scratching our heads about how we would accomplish certain integration points. Options for self-hosting, options for cloud & on-prem applications, custom data and if we have to host a side-by-side database. We wanted to tie all our our separate container applications running out there, into a single sign on, with minimal work. The APIs were very clear, and easy to understand while implementing. We love the transparency of the github repos, so we can comb through the code to see what was being done while doing the integration. In a short 1-2 months of work, we were able to learn about how (with no Oauth/OpenID Connect experience) to integrate our applications in using the standards. FusionAuth has some nice escape hatches for additional information such as their Lambda support and data objects on each entity so you can store arbitrary data for future usages.

Some of the generated SDKs could benefit from a developer that uses the technology suchs as dotnet/core, where the sdks could be better fit to conform to that development standard, but it wasn't a blocking issue. Just using objects that are camel case is kinda foreign, as if you are using java. But this is about as bad as it gets -- it worked as expected without having us spend a ton of time troubleshooting anything.

FusionAuth is API-driven which allows custom authentication flows to be done simply in little time. The whole solution feels well-designed and the team is quick to resolve issues and meet community demands for features as needed.

The CI/CD-based configuration utilities for FusionAuth aren't quite as great as we'd like. They offer a solution for standing up an environment through configuration (Kickstart), but not ongoing configuration, which means if settings are changed in the live environment they aren't peer-reviewed like what we had with Auth0's Terraform provider.

Apart from the top level support for OpenID and OAuth2.0 standards, we like the ease of deployment and the high number of clients available that make it easy to develop with FusionAuth. Furthermore, the possibility to customize the tenant UI produce a smooth UX.

The suite has a lot of features, and the team is constantly working on improvements. Multi-Tenant SSO and iframe token refresh for implicit-grant, which currently are not supported, would be the cherry on the cake.
The logging can be made a bit more verbose in order to quickly debug issues.