WHAT IS IT?
authentik is a self-hosted identity provider that centralises authentication across a whole application estate. It speaks SAML, OAuth2/OIDC, LDAP, RADIUS and SCIM, and can also protect an application that supports none of those by sitting in front of it as a reverse proxy. The core is Python with a TypeScript frontend and outposts written in Go. The model is open core: the core ships under MIT, with a paid Enterprise edition on top.
WHY IS IT INTERESTING?
- Composable authentication flows: the central building block is the flow, a sequence of stages (identification, password, MFA, user write) you assemble yourself. Seven flow types cover authentication, authorization, enrollment, invalidation, recovery, stage configuration and unenrollment.
- Policies evaluated at runtime: policies bind to stages and are evaluated right before a stage is shown, which lets you insert a step conditionally based on the user, their IP or their context.
- Built-in application proxy: outposts put SSO in front of a legacy app without touching its code, and also cover remote access over RDP, VNC and SSH.
- MFA and conditional access: WebAuthn and passkeys, TOTP, plus GeoIP and impossible travel detection to gate access.
- Broad federation: OAuth2/OIDC, OAuth1, SAML2, LDAP and Kerberos as inbound sources, SCIM provisioning outbound to sync accounts into target applications.
USE CASES
- Putting a single SSO in front of a mixed homelab, from a Synology NAS to Grafana
- Protecting an internal app with no OIDC support through the proxy and its outposts
- Opening a self-service enrollment portal with staged validation
- Acting as the LDAP or RADIUS layer for network gear that speaks nothing else
- Provisioning and deprovisioning accounts in target applications over SCIM