We use Keycloak at our place and are really happy with it.

Website: https://www.keycloak.org/

GitHub: https://github.com/keycloak/keycloak

https://github.com/ory/ladon is an option. Essentially, it imposes a lot of the fine-grained access control model on you, but then it's up to you to implement the actual database/business-logic layer [1] as well as the API layer to actually expose the service.

[1] You do so by implementing this interface: https://github.com/ory/ladon/blob/master/warden.go

There's also Open Policy Agent (OPA) https://github.com/open-policy-agent/opa

We use LDAP for managing group memberships (i.e. person x is a member of `engineering` and `eng_team_y`; only members of `eng_team_y` can change the deployment status of service Z). We then define ACLs for these groups. IDK how they are enforced, but they're visible/malleable via Ansible recipes, such that the process of adding permissions for your group (or user) involves submitting a diff to said Ansible recipe and getting approval from an SRE.

In practice, we use Kerberos to obtain/distribute authorization tokens, which live for less than 24 hours. The authorization-value of these tokens is determined by the LDAP affinities of the bearer. If everything is configured correctly (which it always is, until you need new permissions / switch teams), all you have to do is auth with kerberos at the beginning of each day. We have ~200 engineers.

A pretty simple, and configurable one: https://github.com/casbin/casbin