Categories
Security Authentication Reverse Proxy Identity Provider Single Sign-On OpenID Connect Two-Factor AuthenticationStars
Forks
Watchers
Developer links
Authelia
Authelia is the leading open-source SSO and multi-factor authentication server for self-hosted infrastructure. The Go backend compiles to a single binary or Docker container image, serving a TypeScript React web portal that handles first-factor username and password login, second-factor authentication via TOTP, WebAuthn FIDO2 security keys, passwordless passkeys, and Duo mobile push notifications, and an OpenID Connect 1.0 and OAuth 2.0 identity provider with device code flow, JWE encrypted ID tokens, custom claims policies, and network-scoped authorization criteria. The forward authentication model integrates with Nginx auth_request, Traefik ForwardAuth, HAProxy, Caddy, Envoy, SWAG, and Skipper reverse proxies, injecting Remote-User, Remote-Groups, and Remote-Email headers into authorized requests. Granular access control rules match subject, groups, request URI, HTTP method, and network to enforce one-factor and two-factor policies per route. The user backend supports LDAP with attribute mapping, connection pooling, and bind mode, or YAML file-based authentication with Argon2id hashed passwords. Session state stores in Redis for high availability across clustered deployments, while persistent data lives in SQLite, MySQL and MariaDB, or PostgreSQL. Brute force protection locks accounts after configurable failed attempts, and email-based identity verification handles password resets and device registration. Dark, light, and OLED themes with i18n localization customize the portal appearance. On RepoCloud, deploy Authelia on a dedicated VPS with Docker, root SSH access, and complete control over your authentication infrastructure, all under the Apache-2.0 license.
Benefits
- OpenID Certified Identity Provider
- Full OpenID Connect 1.0 and OAuth 2.0 provider certified across Basic, Implicit, Hybrid, Form Post, and Config OP profiles, enabling standards-compliant SSO for all downstream applications.
- Flexible Multi-Factor Authentication
- Three second-factor methods including TOTP authenticator apps, WebAuthn FIDO2 security keys and passwordless passkeys, and Duo mobile push notifications protect against credential compromise.
- Universal Reverse Proxy Integration
- Forward authentication works with Nginx auth_request, Traefik ForwardAuth, HAProxy, Caddy, Envoy, and Skipper, protecting any HTTP application behind your existing proxy infrastructure without application changes.
- Granular Per-Route Access Policies
- Access control rules match users, groups, request URI patterns, HTTP methods, and client networks to enforce one-factor or two-factor policies on each protected route independently.
Features
- Single Sign-On Portal
- Centralized web portal authenticates users once and provides session-based access to all protected applications across multiple domains and subdomains.
- WebAuthn Passkey Authentication
- Level 3 passwordless authentication via FIDO2 WebAuthn passkeys eliminates password dependencies with device-bound cryptographic credentials and resident key support.
- LDAP User Backend
- Connects to Active Directory, OpenLDAP, or FreeIPA with attribute mapping, connection pooling, bind mode authentication, and group-based policy enforcement.
- Multi-Database Persistence
- Stores configuration and user data in SQLite for single-node deployments or MySQL and MariaDB and PostgreSQL for production clusters with Redis session storage.
- OIDC Device Code Flow
- OAuth 2.0 Device Authorization Grant enables authentication on input-constrained devices like smart TVs and CLI tools through browser-assisted code verification.
- Brute Force Protection
- Automatic account lockout after configurable failed authentication attempts with IP-based rate limiting and email identity verification for password resets.