make a table of all the SSO programs

howto/ldap.md

@@ -2258,15 +2258,27 @@ using the [django-auth-ldap][] authentication plugin.
 
 ### Single-sign on
 
- * [Keycloak][]: single-sign-on interface which talks with LDAP
- * [FreeIPA][]: similar, except built on top of 389 DS, the Fedora
-   LDAP thing
- * [Authelia][]: single sign-on, 2fa, OIDC connect
- * [Authentik][]: single sign-on, 2fa, OIDC, SAML, LDAP, proxy,
-   metrics
- * [LemonLDAP-ng](https://lemonldap-ng.org/), [packaged in Debian](https://tracker.debian.org/pkg/lemonldap-ng)
- * [kanidm][]: SSO, 2FA, OIDC, LDAP, Radius, SSH, PAM + offline
-   support, web UI, CLI tools
+"Single-sign on" (SSO) is "an authentication scheme that allows a user
+to log in with a single ID to any of several related, yet independent,
+software systems." -- [Wikipedia](https://en.wikipedia.org/wiki/Single_sign-on)
+
+In our case, it's something that could allow all our applications that
+use a single source of truth for usernames and passwords. We could
+also have a single place to manage the 2FA configurations, so that
+users wouldn't have to enroll their 2FA setup in each application
+individually.
+
+Here's a list of the possible applications that could do this that
+we're aware of:
+
+| Application      | Features                                                                   | Notes                                       |
+|------------------|----------------------------------------------------------------------------|---------------------------------------------|
+| [Keycloak][]     | SSO, LDAP                                                                  |                                             |
+| [FreeIPA][]      | SSO, LDAP                                                                  | built on top of 389 DS (Fedora LDAP server) |
+| [Authelia][]     | SSO, 2FA, OIDC                                                             |                                             |
+| [Authentik][]    | SSO, 2FA, OIDC, SAML, LDAP, proxy, metrics                                 |                                             |
+| [LemonLDAP-ng][] |                                                                            | [packaged in Debian][]                      |
+| [kanidm][]       | SSO, 2FA, OIDC, LDAP, Radius, SSH, PAM + offline support, web/CLI UI, Rust |                                             |
 
 See also [mod_auth_openidc](https://github.com/OpenIDC/mod_auth_openidc) for an Apache module supporting OIDC.
 
@@ -2278,6 +2290,8 @@ swap ud-ldap out if we need to, replacing bits of it as we go.
 [Authelia]: https://www.authelia.com/
 [Authentik]: https://goauthentik.io/
 [kanidm]: https://github.com/kanidm/kanidm
+[LemonLDAP-ng]: https://lemonldap-ng.org/
+[packaged in Debian]: https://tracker.debian.org/pkg/lemonldap-ng
 
 #### Keycloak