authelia: Add SSO and Multi-Factor Authentication to Web Apps

Overview

Authelia is an authentication and authorization service for applications behind a reverse proxy. It gives users a central portal for signing in and lets administrators control which requests require authentication, while the proxy uses Authelia to allow, deny, or redirect access.

It is aimed at people operating their own web services, especially in Docker or Kubernetes environments. It can also provide OpenID Connect and OAuth 2.0 identity-provider capabilities. Authelia is not a reverse proxy itself, and deployment requires configuring it alongside a supported proxy and identity or user-storage setup.

Key Features

• Single sign-on and multi-factor authentication through a web portal.
• Second factors include WebAuthn security keys, time-based one-time passwords, and Duo push notifications.
• Passwordless authentication using WebAuthn passkeys.
• Fine-grained access rules based on criteria such as users, groups, subdomains, request paths, methods, and networks.
• OpenID Connect 1.0 and OAuth 2.0 identity-provider support. The project describes this offering as beta on its roadmap.
• Integrations with nginx, Traefik, Caddy, Skipper, Envoy, and HAProxy.
• Deployment options include containers, Kubernetes, packages, and static binaries.

Use Cases

• Home-lab operators can add a shared login and second-factor checks to self-hosted services behind a reverse proxy.
• Small infrastructure teams can apply different authentication policies to internal applications and endpoints.
• Kubernetes administrators can protect ingress-routed applications using supported ingress controllers or gateways.
• Application developers can use its OpenID Connect provider when they need an identity service for their applications, while accounting for its beta status.

Project Facts

• Language: Go
• License: Apache-2.0
• Stars: 29.2k
• Forks: 1.5k
• Topics: 2fa, authentication, docker, golang, kubernetes, ldap, mfa, multifactor, oauth2, openid-connect, passkeys, pqc, push-notifications, security, sso, sso-authentication, totp, two-factor, two-factor-authentication, webauthn
• Archived: No

Getting Started

Start with the Get Started Guide and the deployment documentation. Docker Compose examples are provided as starting points, but require customization before use. See the README for installation options and project details.

Alternatives

• docker-tinyauth: Tinyauth is a lightweight authentication middleware for reverse proxies, while Authelia offers broader SSO, access policies, and second-factor options.

Considerations

• Authelia works alongside a reverse proxy; it does not replace one. Proxy integration and application routing must be configured.
• It is security-sensitive infrastructure and should be protected and maintained carefully, even though the README says it is not directly exposed to the internet.
• The project warns that breaking changes may occur during active development. Pin a release version and review release notes before upgrading.
• OpenID Connect support is described as beta on the project roadmap.
• The lightweight Docker Compose example uses file-based user storage and SQLite, and the README cautions that this setup will not scale well.