authentik Identity Provider: Self-Hosted SSO
/authentik
authentik is a self-hosted identity provider that consolidates SAML, OAuth2/OIDC, LDAP, and RADIUS behind one login flow instead of bolting each protocol onto its own service. Reach for it if you want SSO you control end to end and don't mind running Docker Compose or a Helm chart yourself; skip it if you'd rather not own patching, backups, and uptime for the system that gates every other login.
Understanding Authentik's Role
authentik is an open-source identity provider (IdP) built to sit in front of your other applications and handle sign-in through SAML, OAuth2/OIDC, LDAP, or RADIUS. It solves the problem of stitching together separate auth systems for old and new apps by giving them one shared login backend, and the project scales from a single Docker Compose stack in a home lab to a Kubernetes cluster running production traffic.
Core Identity and Access Protocols
- ✓Speaks SAML, OAuth2/OIDC, LDAP, and RADIUS out of the box, so authentik can front both a legacy app that only understands LDAP and a modern app that expects an OIDC token.
- ✓Works as both a SAML IdP and a SAML SP, which matters when authentik needs to issue assertions to one app and consume them from another.
- ✓Ships an enterprise tier for larger identity-management needs - the README frames it as a way to move off another commercial identity provider.
- ✓Tagged for reverse-proxy use, letting authentik sit in front of apps that have no native SSO support of their own.
- ✓Built in Python, which matters if your team wants to read the source or patch a policy instead of waiting on a vendor.
- ✓Designed to run anywhere from a small self-hosted lab to a large production cluster, per the project's own description.
Deployment Options for Authentik
authentik lists four deployment paths in its docs, and none of them is a single binary you just run. Docker Compose is the one the project recommends for small or test setups. For larger setups, the recommended path is a Kubernetes Helm chart, with the chart kept in a separate goauthentik/helm repository. If you're on AWS, there are official CloudFormation templates; DigitalOcean lists authentik as a one-click app in its Marketplace. Beyond those four entry points, the README doesn't spell out CLI commands or config file contents - for that, it points to a separate documentation site rather than including it inline.
Who Can Benefit from Authentik?
authentik fits teams running their own infrastructure who want a single login system in front of a mix of old and new applications - self-hosters, homelab operators, and platform teams already running Kubernetes who don't want to hand identity data to a third party. It's a worse fit if you want a login screen with zero operational involvement, since even the Docker Compose path means you're the one keeping containers patched and the database backed up.
Comparing Authentik to Commercial IdPs
Strengths
- ✓Covers SAML, OAuth2/OIDC, LDAP, and RADIUS in one project, so you're not running four separate services to cover four protocols.
- ✓Multiple deployment paths - Docker Compose, a Kubernetes Helm chart, AWS CloudFormation, and a DigitalOcean Marketplace app - instead of one blessed route.
- ✓Built in Python, so extending or auditing the logic doesn't mean learning an unfamiliar toolchain if your team already works in Python.
- ✓Enough of a community that the Helm chart and docs aren't resting on one maintainer.
Considerations for Authentik Deployment
- △Running authentik yourself means you own the operational load - patching containers, backing up the database, watching for CVEs in a system that gates every other login - and the README doesn't soften that trade-off.
- △The README text provided here doesn't state a license, so check the actual LICENSE file before committing to authentik for a production identity system.
- △The enterprise tier pitched as an Okta/Auth0 replacement isn't detailed beyond a link to a pricing page - there's no feature-by-feature breakdown in the README.
- △Nothing here is turnkey. Every deployment path - Docker Compose, Helm, CloudFormation - means learning that platform's own operational quirks on top of authentik's.
Frequently Asked Questions
authentik is open-source, hosted on GitHub under the goauthentik organization, and works as an identity provider supporting SAML, OAuth2/OIDC, LDAP, and RADIUS.
authentik supports four deployment paths: Docker Compose for small or test setups, a Kubernetes Helm chart for larger setups, official AWS CloudFormation templates, and a one-click DigitalOcean Marketplace app.
authentik supports SAML, OAuth2/OIDC, LDAP, and RADIUS, per the project's own description, letting it front both legacy and modern applications from one login backend.
authentik has an enterprise offering aimed at organizations that want to replace an existing commercial IdP like Okta, Auth0, Entra ID, or Ping Identity at larger scale; pricing details live on the project's own site rather than in the README.
authentik's own README positions its enterprise offering as a way to replace IdPs such as Okta and Auth0, though switching means taking on hosting and maintenance yourself instead of paying a vendor to handle it.
authentik's developer documentation covers setting up local build environments, testing contributions, and the contribution process, and the project keeps a separate style guide for anyone submitting documentation changes.
The problem it solves
Self-hosted teams running a mix of old and new apps end up gluing together separate logins: LDAP for the legacy system, OAuth2 for the newer internal tool, SAML for whatever an old identity vendor demanded. authentik's whole reason to exist is being that connective layer - one login backend that speaks all four protocols - instead of making you run four separate auth services just to get one sign-in screen.
Best use cases
- •Fronting a handful of self-hosted apps (a wiki, a monitoring dashboard, a Git server) with one login instead of separate accounts per app.
- •Bridging an old LDAP- or RADIUS-only system with newer apps that only speak OAuth2/OIDC.
- •Running SSO inside a Kubernetes cluster via the Helm chart, alongside the other workloads it's protecting.
- •Testing or evaluating a self-hosted IdP before deciding whether to move off Okta, Auth0, Entra ID, or Ping Identity.
Related repositories
Want a second opinion on authentik?
Ask an AI that can read this page — one click and you get its take on authentik.