authentik Blog

Authentik Security | Senior Engineer | US | REMOTE (anywhere) | Full-time Authentik Security (https://goauthentik.io) is the company behind authentik (https://github.com/goauthentik/authentik), an open source identity provider with 1M+ unique installations. Help us replace Okta/Auth0, Ping Identity, and Microsoft Entra with modern, secure identity for all! We are a small remote team, looking to scale up with experienced software engineers, primarily with a backend focus. Bonus points if you have significant experience with identity/SSO standards and/or Django/Python. There is also the opportunity to be "forward deployed" spending 20%+ of time with enterprise customers (remotely) on configuration best practices and rollout strategies, _if_ that is of interest to the right candidate. To apply, please use: https://forms.gle/NYXH4E19LUohbpmJA

> If someone tries to program [auth] themselves, they either do it incorrectly (or not well enough) or keep an expert busy for weeks and weeks. Or they could set up something like https://goauthentik.io/? (Shameless plug: if you use my Docker dashboard, https://lunni.dev/, you can install it in a couple clicks from the Marketplace.) Or any other open source option – there are dozens at this point. And honestly speaking, auth isn’t that hard in the first place. You do have to remember a few things, but if you follow something like https://lucia-auth.com/ it shouldn’t take you more than an hour to set up some decent auth with 2FA and OIDC support. A bit more time to implement sign-in rate limiting and email verification and you have a robust system that (a) works in a way that you understand and (b) you can reuse between projects without paying a dime.

Absolutely, would love OIDC/OAuth. I use https://goauthentik.io/. Teedy supports only LDAP so that's what I'm using right now.

What do folks think about authentik[0]? I tried to set up Keycloak but after fiddling with it for awhile before giving up and trying something else. It felt really weird that I was just extracting a tar and running a jar instead of some pre-packaged solution, but that might just be me. authentik was pretty easy to set up for my homelab, but maybe I'm missing something given all the positive recommendations for Keycloak? [0]: https://goauthentik.io/

Authentik is also worth checking out: https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.

My favorite in this space is authentik. It manages to have more features than most while being easier to use. https://goauthentik.io/

I recently set up passkey-only sign ins for a webapp I'm writing using Authentik [0](Python OIDC provider, with quite a nice docker-compose run-up, took only minutes to stand up.) It was surprisingly easy to configure everything so that passkeys are the only thing ever used. If anyone would be interested I could write it up? I was surprised what a nice user flow it is and how easy it was to achieve. [0] https://goauthentik.io/

I set up Authentik[^1] on my NAS in a docker container and went from there! Just had to add a .well-known webfinger file to my domain that pointed to the Authentik instance and it "just worked" with Tailscale. [^1]: https://goauthentik.io/

> Honest to god, if an IdP like Okta made an Active Directory replacement that ran via container https://goauthentik.io/ can run in docker. It can be paired in with openldap containers, too.

While authelia is quite cool "infra-as-code" tool, since you have your entire configuration in yaml form, for those not willing to spend a few evenings configuring SSO, there is authentik [1] which features management UI. Offers similar feature set, also self-hostable, but most importantly - simple to set-up. I've spent 8h on authelia deployment, where 30 minutes in authentik would be sufficient. But both are good options, pick what you prefer. 1: https://goauthentik.io/

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started. [1] https://goauthentik.io/ [2] https://www.authelia.com/

How does zitadel compare to authentik (https://goauthentik.io/) or authelia (https://www.authelia.com/)?

That it is, but is a bit convoluted. I ended up settling on Authentik. [0] [0] https://goauthentik.io/

> We’re launching our first OPBC company, Authentik Security, in November. Authentik Security is a cyber security company that provides identity management solutions around single-sign-on, user enrollment, and other access control features. This Authentik? https://goauthentik.io The maintainer works in Yelp(1), so is the company not associated with the actual founder of the project? 1. https://github.com/BeryJu

Selfhosted https://goauthentik.io/

Personally I went with Keycloak, because it's fairly well documented and also has Docker images available: https://www.keycloak.org/getting-started/getting-started-docker although the fact that they want you to create an "optimized" image yourself and have a long setup process on startup otherwise is slightly annoying: https://www.keycloak.org/server/containers Regardless, with something like mod_auth_openidc or another Relying Party implementation, all of the sudden authn/authz becomes easier to manage (you can literally get user information including roles in headers that are passed from your gateway/relying party to apps behind the reverse proxy), regardless of what you have actually running your APIs: https://github.com/OpenIDC/mod_auth_openidc (there are other options, of course, but I went with that because I already use mod_md). It's actually cool that there are plentiful options in the space, since OIDC is pretty complex in of itself and attempts at creating something pleasant to actually use are always welcome, I've also heard good things about Authentik: https://goauthentik.io/

Some I found: - I believe it does offer trusted header auth, although I haven’t used it for any of my apps to test out. https://goauthentik.io/docs/providers/proxy/custom_headers - It doesn’t offer “Passwordless email login”, but offers “passwordless login” in the form of passkeys (with a tiny bit of setup). - Definitely offers upstream OIDC, I have my instance set up to be able to sign in through AAD or locally. https://goauthentik.io/integrations/sources

I was interested in Authentik, but I was perusing the docs and was extremely put off by the way in which Authentik manages itself as well as additional “outposts”. > The docker integration will automatically deploy and manage outpost containers using the Docker HTTP API. > This integration has the advantage over manual deployments of automatic updates (whenever authentik is updated, it updates the outposts) NO. I do not want software I use to update itself automatically in prod. And I especially do not want to give a docker socket to it so that it can automatically add new components. https://goauthentik.io/docs/outposts/integrations/docker