A simple username/email and password solution seems like it'd solve authentication, but isn't that obvious?
Authorization depends totally on what your app actually needs, e.g., do different users have different roles? How fine-grained does the authorization need to be?
Is just a "user" level and an "admin" level enough? I guess this is perhaps a bit app specific.
Is authenticating against RADIUS, or AD a must? Okta? How about Google Apps? I don't think GitHub is important in my case. Whats come to be a given here?
No way to know if non-granular "user" and "admin" are sufficient. For a lot of apps they are. For many it's more of a "user of a group" and "admin of a group" which is still straight-forward. Granular authorization can be a challenge if it wasn't architected in at the beginning, but even then it just depends.
In terms of authenticating against providers, who knows. For me, local auth, Google, FB, Twitter, and GH are more than enough, but your needs may vary.