Comparison
Open-source privileged access management
Also searched as open-source PAM, free PAM software, and self-hosted privileged access management.
"Open source" in this category now covers three different licensing situations. Which one a tool is in matters more than its feature list.
Open-source privileged access management is PAM software whose source code you can read, run, modify and redistribute under an OSI-approved license. In 2026 that sits alongside two look-alikes: source-available tools, whose code is public but whose license restricts use, and tools whose source is open but whose ready-to-run binaries carry a commercial license.
The tools, by job and by license
| Tool | What it does | License (repository, Sept 2026) | What that means for you |
|---|---|---|---|
| JumpServer | "Open-source PAM platform" for SSH, RDP, Kubernetes, databases and more | GPL-3.0 | Open source. Changes you distribute must stay GPL. |
| Warpgate | SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion "that doesn't require a client app" | Apache-2.0 | Open source, permissive. |
| Teleport | Infrastructure access for SSH, Kubernetes and databases with short-lived certificates | Source AGPL-3.0; Community Edition binaries under a commercial license from v16 | Build it yourself under AGPL, or use the free binaries only if you are under 100 employees and $10M revenue. |
| HashiCorp Boundary | Identity-based session access to hosts and services | Business Source License 1.1 from v0.14.0; licensor IBM | Source-available, not open source. Production use is allowed unless you offer it to others in competition with IBM's paid versions. |
| Pomerium | "An identity and context-aware access proxy" | Apache-2.0 | Open source, permissive. |
| Apache Guacamole | Clientless remote-desktop gateway | Apache-2.0 | Open source, permissive. |
| OpenBao | Manages, stores and distributes secrets, certificates and keys | MPL-2.0 | Open source; file-level copyleft. |
| Discord's Access | A portal to "discover, request, and manage" access, including temporary access, over Okta groups | Apache-2.0 | Open source, permissive. Okta only. |
The first five are gateways or bastions: they sit between people and infrastructure and broker sessions. OpenBao is a secrets vault. Discord's Access is the odd one out, and the closest to what this site is about: it grants membership of existing groups, with an end time, rather than brokering sessions.
Three licensing situations, and why they matter
Open source
An OSI-approved license — GPL, Apache, MPL. You can run it in production, modify it and fork it if the project changes direction. The risk is operational, not legal: you run the upgrades and the security patches.
Source-available
The code is public and you can read it, but the license restricts some use. Boundary's Business Source License allows production use except offering it in competition with IBM's paid versions, which covers most companies running it for themselves — but it is not open source, and a license that has changed once can change again for future versions.
Open source, with commercial binaries
Teleport's source is AGPL, but the Community Edition you download ready to run is under a commercial license from v16 with a size limit. Building from source keeps you under AGPL terms; using the binaries past the size limit means a commercial agreement. It is worth knowing which of the two your team actually does.
What to check before you self-host a free PAM
- The license of the version you will run, not the project's reputation. Several tools here were more open three years ago than they are now.
- Who owns upgrades. Access infrastructure is a security boundary, and an unpatched one is worse than none. Budget the hours, not just the license fee you are saving.
- What happens to revocation when it is down. If the service that removes access stops, does access stay granted? Self-hosting means you operate the removal path, and a removal path nobody is watching is how temporary access becomes permanent. The just-in-time guide covers why this is the half that decides whether any of it worked.
- Which job you need. A bastion does not remove anyone's standing admin in the identity provider, and a group-membership tool does not record sessions. Just-in-time access tools compared sorts the commercial products by the same jobs.
Where TemprBac fits
TemprBac is not open source. It is self-hostable: it can run inside your own infrastructure and compliance boundary, or be hosted by us. It grants time-bound membership of groups across Entra ID, Okta, Google Workspace, GitHub, AWS IAM and Active Directory, at a published price, with single sign-on on every tier. If an OSI license is a hard requirement, one of the tools above is the answer and this is not. If what you wanted was a price you can see and software you can run yourself, it may be. Who it is for says which in two minutes.