Overview

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for web applications via a web portal. It acts as a companion for reverse proxies like Nginx, Traefik, and HAProxy, adding a robust identity layer in front of your services. Authelia is OpenID Certified™ as an OpenID Connect 1.0 provider and supports a wide range of authentication methods including passwords, one-time codes, security keys, and push notifications.

Designed for self-hosters and organizations, Authelia integrates with existing LDAP directories or can manage local users through its YAML configuration. Its flexible access rules let you define precisely who can access what, under which conditions, and with which authentication methods — enabling granular security policies per application, per user group, or per network zone.

Key Features

• Multiple Two-Factor Methods: Time-based One-Time Passwords (TOTP), Duo Push notifications, WebAuthn (passkeys, security keys, Touch ID/Windows Hello), and YubiKey.
• Single Sign-On (SSO): Authenticate once and access all protected applications without re-entering credentials.
• OpenID Connect 1.0 (OIDC): Full OIDC provider implementation for modern applications, certified by the OpenID Foundation.
• LDAP Integration: Connect to existing LDAP directories (OpenLDAP, FreeIPA, Active Directory) or use the built-in local user store.
• Flexible Access Control: Define per-resource, per-user, and per-group authorization policies with optional time-based and network-based constraints.
• Identity Brokering: Support for OAuth 2.0 providers (Google, GitHub, Apple, etc.) as external identity sources.
• Session Management: Configurable session lifetime, remember-me duration, and inactivity timeouts with Redis-backed persistence.
• Docker-Native: First-class Docker support with Compose examples and Kubernetes Helm charts.

Use Cases

• Adding SSO and MFA to self-hosted services behind a reverse proxy.
• Securing internal company dashboards and tools with centralized authentication.
• Providing OIDC integration for custom applications and third-party tools.
• Replacing commercial identity providers with a self-hosted, privacy-focused alternative.

Platforms

Linux, Docker, Kubernetes (cross-platform via container deployment)

Licence

Apache 2.0 (open source)

Website

http://www.authelia.com | github.com/authelia/authelia