The team behind authentik, an open-source identity provider, writes about engineering choices, self-hosting identity, and licensing.
HN commenters recommend authentik as a self-hosted alternative to Keycloak, praising its built-in forward auth. The company also posts hiring notices.
Personally I went with Keycloak, because it's fairly well documented and also has Docker images available: https://www.keycloak.org/getting-started/getting-started-docker although the fact that they want you to create an "optimized" image yourself and have a long setup process on startup otherwise is slightly annoying: https://www.keycloak.org/server/containers
Regardless, with something like mod_auth_openidc or another Relying Party implementation, all of the sudden authn/authz becomes easier to manage (you can literally get user information including roles in headers that are passed from your gateway/relying party to apps behind the reverse proxy), regardless of what you have actually running your APIs: https://github.com/OpenIDC/mod_auth_openidc (there are other options, of course, but I went with that because I already use mod_md).
It's actually cool that there are plentiful options in the space, since OIDC is pretty complex in of itself and attempts at creating something pleasant to actually use are always welcome, I've also heard good things about Authentik: https://goauthentik.io/
> If someone tries to program [auth] themselves, they either do it incorrectly (or not well enough) or keep an expert busy for weeks and weeks.
Or they could set up something like https://goauthentik.io/? (Shameless plug: if you use my Docker dashboard, https://lunni.dev/, you can install it in a couple clicks from the Marketplace.) Or any other open source option – there are dozens at this point.
And honestly speaking, auth isn’t that hard in the first place. You do have to remember a few things, but if you follow something like https://lucia-auth.com/ it shouldn’t take you more than an hour to set up some decent auth with 2FA and OIDC support. A bit more time to implement sign-in rate limiting and email verification and you have a robust system that (a) works in a way that you understand and (b) you can reuse between projects without paying a dime.
Authentik Security | Senior Engineer | US | REMOTE (anywhere) | Full-time
Authentik Security (https://goauthentik.io) is the company behind authentik (https://github.com/goauthentik/authentik), an open source identity provider with 1M+ unique installations. Help us replace Okta/Auth0, Ping Identity, and Microsoft Entra with modern, secure identity for all!
We are a small remote team, looking to scale up with experienced software engineers, primarily with a backend focus. Bonus points if you have significant experience with identity/SSO standards and/or Django/Python.
There is also the opportunity to be "forward deployed" spending 20%+ of time with enterprise customers (remotely) on configuration best practices and rollout strategies, _if_ that is of interest to the right candidate.
To apply, please use: https://forms.gle/NYXH4E19LUohbpmJA
I was interested in Authentik, but I was perusing the docs and was extremely put off by the way in which Authentik manages itself as well as additional “outposts”.
> The docker integration will automatically deploy and manage outpost containers using the Docker HTTP API.
> This integration has the advantage over manual deployments of automatic updates (whenever authentik is updated, it updates the outposts)
NO. I do not want software I use to update itself automatically in prod. And I especially do not want to give a docker socket to it so that it can automatically add new components.
https://goauthentik.io/docs/outposts/integrations/docker
While authelia is quite cool "infra-as-code" tool, since you have your entire configuration in yaml form, for those not willing to spend a few evenings configuring SSO, there is authentik [1] which features management UI.
Offers similar feature set, also self-hostable, but most importantly - simple to set-up. I've spent 8h on authelia deployment, where 30 minutes in authentik would be sufficient. But both are good options, pick what you prefer.
1: https://goauthentik.io/
Some I found:
- I believe it does offer trusted header auth, although I haven’t used it for any of my apps to test out. https://goauthentik.io/docs/providers/proxy/custom_headers
- It doesn’t offer “Passwordless email login”, but offers “passwordless login” in the form of passkeys (with a tiny bit of setup).
- Definitely offers upstream OIDC, I have my instance set up to be able to sign in through AAD or locally. https://goauthentik.io/integrations/sources