Canonical Identity Provider (https://launchpad.net/canonical-identity-provider) behind Ubuntu SSO is free software, but the documentation is lacking (it's an openid provider with oauth support for application tokens; not sure if it's been moved to openid connect). To get proper users and groups, you'd needed to extract Launchpad Registry from Launchpad itself (https://launchpad.net/launchpad), though I think some "teams" functionality was added to Identity Provider itself.
In general, if more sites grew proper OpenID auth vs justa subset of providers, we'd see more people run their own OpenID servers to authenticate against external services.
Basically, for an open source/free software service to succeed in this area, it needs to allow both federated and SaaS model because that's how free software people are :) And federated is hard because nobody accepts pure OpenID anymore (and it's funny: you'll trust an email address but not a URL as a unique identifier). But it's probably how hard it was to get working that's the issue.
In general, if more sites grew proper OpenID auth vs justa subset of providers, we'd see more people run their own OpenID servers to authenticate against external services.
Basically, for an open source/free software service to succeed in this area, it needs to allow both federated and SaaS model because that's how free software people are :) And federated is hard because nobody accepts pure OpenID anymore (and it's funny: you'll trust an email address but not a URL as a unique identifier). But it's probably how hard it was to get working that's the issue.