Overview

authentik is an open-source Identity Provider (IdP) and Single Sign-On (SSO) platform built with security at the forefront of every component. It serves as a flexible authentication glue for organizations, supporting all major authentication and authorization protocols including OAuth2/OIDC, SAML, and LDAP. Unlike single-protocol solutions, authentik can act simultaneously as an identity provider, an OAuth2 client proxy, and a SAML service provider, bridging authentication between heterogeneous systems.

authentik features a modern web-based admin interface for configuring providers, applications, policies, and flows. Its policy engine allows dynamic access decisions based on user attributes, group membership, device state, and contextual signals. The built-in flow designer lets administrators customize the entire authentication journey — from login screens to password reset flows — without writing code.

Key Features

• Universal Protocol Support: OAuth2, OpenID Connect 1.0 (OIDC), SAML 2.0, LDAP, and SCIM provisioning in a single platform.
• Policy-Based Access Control: Dynamic authorization using Python-based policy engine with user, group, attribute, and context matching.
• Visual Flow Designer: Drag-and-drop builder for authentication flows — login, registration, password reset, enrolment, and custom workflows.
• Self-Service Portal: User-facing dashboard for managing passwords, MFA devices, sessions, and application access.
• Multi-Factor Authentication: TOTP, WebAuthn (passkeys/security keys), Duo Push, SMS, and email-based one-time codes.
• Reverse Proxy Integration: Built-in outpost system that deploys alongside reverse proxies (Traefik, Nginx, Caddy) for header-based authentication.
• SCIM Provisioning: Automated user and group provisioning to downstream applications supporting the SCIM 2.0 protocol.
• Kubernetes-Native: First-class Helm chart with custom resource definitions (CRDs) for Kubernetes deployments.

Use Cases

• Centralized SSO across cloud and on-premise applications with mixed protocol support.
• Replacing commercial IdP solutions (Okta, Azure AD) with a self-hosted alternative.
• Providing LDAP-compatible authentication for legacy applications alongside modern OIDC apps.
• Automated user lifecycle management with SCIM provisioning across SaaS tools.

Platforms

Linux, Docker, Kubernetes

Licence

MIT (open source)

Website

goauthentik.io | github.com/goauthentik/authentik