I agree about the Persona bit, but many times you are not ... shall we say "allowed" to.

Since you built an SSO, could you point me in the right direction amongst self-hosted solutions. Some comparisons and pitfalls would be most welcome.