authentik

An open-source Identity Provider with a unique visual Flow Engine for custom authentication pipelines. authentik supports OIDC, OAuth 2.0, SAML, forward authentication (protect any app via nginx/Traefik without code changes), and enterprise LDAP/SCIM — all configurable from a rich admin UI.

What is authentik?

authentik's defining feature is its Flow Engine: authentication is a sequence of configurable Stages (identification, password check, MFA, consent, email verification) with Python expression Policies controlling which stages activate for which users. This visual pipeline lets non-engineers customize the entire login experience — add invite-only registration, require MFA for admin users, or redirect enterprise users to their SAML provider — all from the admin UI.

The Outpost system is authentik's other standout feature: deploy an authentik Outpost as a Traefik or nginx forward-auth middleware, and any app behind the proxy gets SSO protection without changes to the app itself. This makes authentik ideal for protecting internal tools, dashboards, and legacy applications that can't be instrumented.

Quick Start (Docker Compose)

# authentik — docker-compose setup
# 1. Download official compose file
curl -O https://goauthentik.io/docker-compose.yml

# 2. Generate secret key and admin password
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 36)" >> .env
echo "AUTHENTIK_BOOTSTRAP_PASSWORD=your-admin-password" >> .env
echo "AUTHENTIK_BOOTSTRAP_TOKEN=your-api-token" >> .env

# Optional: email config for invites and MFA
cat >> .env << 'EOF'
AUTHENTIK_EMAIL__HOST=smtp.gmail.com
AUTHENTIK_EMAIL__PORT=587
[email protected]
AUTHENTIK_EMAIL__PASSWORD=app-password
[email protected]
EOF

# 3. Start
docker compose up -d

# Access: http://localhost:9000/if/flow/initial-setup/

Provider Types

# authentik Provider types
# Available via Admin UI → Applications → Providers

# OIDC/OAuth2 Provider
- Protocol: OpenID Connect / OAuth2
- Client ID: (auto-generated or custom)
- Client Secret: (auto-generated)
- Redirect URIs: https://app.example.com/callback
- Scopes: openid, email, profile, groups

# SAML Provider (for enterprise SSO)
- SSO URL: https://auth.example.com/application/saml/myapp/sso/binding/post/
- Entity ID: https://app.example.com/saml/metadata

# Proxy Provider (forward auth for nginx/Traefik)
- Internal host: http://myapp:3000
- External host: https://app.example.com
- Authentik handles auth; proxies valid requests

Flow Engine Examples

# authentik Flows — customize the login experience
# Flows are the building blocks of the auth UX

Default flow order:
1. Identification Stage  → ask for username or email
2. Password Stage        → check password
3. MFA Stage             → TOTP / WebAuthn / SMS (if enrolled)
4. User Login Stage      → create session

Custom flow examples:
- Passwordless: Identification → WebAuthn → Login
- Invite-only: Email Verification → Password Set → Login
- B2B SSO: Source redirect → SAML assertion → Login

# Policies (Python expressions) control flow branching:
# "Show MFA only if user is in 'admin' group"
return ak_is_group_member(request.user, name="admins")

# "Block login from certain IPs"
from netaddr import IPNetwork, IPAddress
return IPAddress(request.context["remote_ip"]) not in IPNetwork("10.0.0.0/8")

Forward Auth (Traefik/nginx)

# authentik Outpost — forward auth for nginx/Traefik

# Traefik labels
labels:
  - traefik.http.middlewares.authentik.forwardauth.address=http://authentik-outpost:9000/outpost.goauthentik.io/auth/traefik
  - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
  - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-uid,X-authentik-groups

# Nginx location block
location / {
  auth_request /outpost.goauthentik.io/auth/nginx;
  error_page 401 = @goauthentik_proxy_signin;
  auth_request_set $authentik_status $upstream_status;
}